What is the CVSS score of CVE-2026-55410?

CVE-2026-55410 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-55410?

Yes, a public proof-of-concept exploit is available for CVE-2026-55410. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-55410?

Yes, a patch is available for CVE-2026-55410. Update the affected software to the latest version immediately.

NocoBase CVE-2026-55410

EUVD-2026-44804 MEDIUM

OS Command Injection (CWE-78)

2026-07-15 GitHub_M

GHSA-p853-83gj-wjj3

PostgreSQL Command Injection Node.js Nocobase

6.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

7.2 HIGH

RCE as server process yields full confidentiality loss (C:H not C:L); all other metrics align with the description and PR:H requirement.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 22:33 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 21:04 vuln.today

Analysis Generated

Jul 15, 2026 - 21:04 vuln.today

DescriptionCVE.org

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

AnalysisAI

Command injection in NocoBase's @nocobase/plugin-backups prior to v2.1.19 allows an authenticated backup-management user to execute arbitrary OS commands as the NocoBase server process by restoring a crafted backup archive. The database.schema field from a backup's _metadata.json is interpolated directly into a shell command string passed to Node.js child_process.exec(), a classic CWE-78 pattern that bypasses any sanitization at the shell level. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, but the commit diff confirms the mechanism is straightforward and the fix is available in v2.1.19.

Technical ContextAI

The affected component is the NocoBase backup plugin (@nocobase/plugin-backups), which uses Node.js child_process.exec() to invoke PostgreSQL utilities (pg_dump/pg_restore) during backup and restore operations. The exec() API passes its first argument as a full shell command string to /bin/sh, making it inherently susceptible to shell metacharacter injection when any part of the command is derived from untrusted input. The database.schema value read from _metadata.json inside the backup archive is controlled by whoever created the archive - an attacker can embed shell metacharacters (e.g., '; malicious_command #') to break out of the intended command context. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause class. The fix migrates to child_process.spawn() with discrete argument arrays, which bypasses the shell entirely and is the canonical Node.js remediation for this class. CPE: cpe:2.3:a:nocobase:nocobase:*:*:*:*:*:*:*:* (all versions prior to 2.1.19, PostgreSQL backend). The vulnerability does not affect non-PostgreSQL database backends as the injection is in the PostgreSQL-specific restore path.

RemediationAI

Upgrade to NocoBase v2.1.19 or later, which resolves this vulnerability by replacing child_process.exec() with child_process.spawn() (discrete argument array form) in the backup plugin's PostgreSQL restore path, confirmed by commit 0e1aba1b7b112ffc841588963f7343c00edd9806. The release is available at https://github.com/nocobase/nocobase/releases/tag/v2.1.19 and the advisory is at https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3. If immediate upgrade is not possible, disable the @nocobase/plugin-backups plugin entirely - this eliminates the attack surface with the trade-off of losing all backup and restore functionality. As an additional compensating control, restrict the backup management role to the minimum number of trusted accounts and audit who holds that privilege, since exploitation requires that specific role. Never restore backup archives from untrusted or externally supplied sources regardless of patch status.