https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 14:28:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338608 EUVD-2026-338608 https://cve.radiocsirt.org/vuln/euvd-2026-338608 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55410 <p>NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.</p> <p>NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55410 https://cve.radiocsirt.org/vuln/ghsa-p853-83gj-wjj3 <p><strong>Affected:</strong> npm: @nocobase/plugin-backups</p> <p>### Summary NocoBase `@nocobase/plugin-backups` 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js `child_process.exec()`. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in `_metadata.json` under `database.schema`, causing arbitrary commands to execute as the NocoBase server process during restore.</p> <p>The vulnerable plugin is included in the default `@nocobase/preset-nocobase` package and is guarded by the backup-management ACL snippet (`backups:*` / `backup:*`). This is not unauthenticated; the attacker must have backup restore privileges or equivalent access to the restore API/CLI.</p> <p>### Details Affected product evidence: - Ecosystem/package: npm package `@nocobase/plugin-backups` from `packages/plugins/@nocobase/plugin-backups/package.json`. - Tested vulnerable version: `2.0.57` (`packages/plugins/@nocobase/plugin-backups/package.json:1-16`). - Tested commit: `e03d267362b3426f484c28783020b4a2a08911e8`. - Default/common inclusion: `@nocobase/preset-nocobase` depends on and lists `@nocobase/plugin-backups` 2.0.57 as built in (`packages/presets/nocobase/package.json:22-24`, `packages/presets/nocobase/package.json:115-128`). - Affected range estimate: at least the tested `2.0.57` checkout. Earlier/later versions were not tested. - Patched version: unknown/not available in this local checkout.</p> <p>Source-to-sink…</p> <p><strong>Affected:</strong> npm: @nocobase/plugin-backups</p> <p>### Summary NocoBase `@nocobase/plugin-backups` 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js `child_process.exec()`. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in `_metadata.json` under `database.schema`, causing arbitrary commands to execute as the NocoBase server process during restore.</p> <p>The vulnerable plugin is included in the default `@nocobase/preset-nocobase` package and is guarded by the backup-management ACL snippet (`backups:*` / `backup:*`). This is not unauthenticated; the attacker must have backup restore privileges or equivalent access to the restore API/CLI.</p> <p>### Details Affected product evidence: - Ecosystem/package: npm package `@nocobase/plugin-backups` from `packages/plugins/@nocobase/plugin-backups/package.json`. - Tested vulnerable version: `2.0.57` (`packages/plugins/@nocobase/plugin-backups/package.json:1-16`). - Tested commit: `e03d267362b3426f484c28783020b4a2a08911e8`. - Default/common inclusion: `@nocobase/preset-nocobase` depends on and lists `@nocobase/plugin-backups` 2.0.57 as built in (`packages/presets/nocobase/package.json:22-24`, `packages/presets/nocobase/package.json:115-128`). - Affected range estimate: at least the tested `2.0.57` checkout. Earlier/later versions were not tested. - Patched version: unknown/not available in this local checkout.</p> <p>Source-to-sink…</p> https://cve.radiocsirt.org/vuln/ghsa-p853-83gj-wjj3