CVE-2026-55410 nocobase CVE debrief

Who should care

Users of NocoBase versions prior to 2.1.19 should apply the patch to prevent exploitation. This includes administrators, developers, and security teams responsible for managing and securing NocoBase deployments. Additionally, operators and platform administrators should review the vulnerability and take necessary actions to protect their systems.

Technical summary

The @nocobase/plugin-backups component of NocoBase interpolates the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(). A backup-management user can exploit this to execute commands as the NocoBase server process by restoring a crafted backup. The vulnerability is fixed in version 2.1.19. The CVSS score of 6.7 indicates a medium severity vulnerability. The vulnerability allows for command execution, which can lead to unauthorized access and modification of sensitive data.

Defensive priority

Medium priority given the CVSS score of 6.7 and the potential for command execution.

Recommended defensive actions

• Apply the patch by upgrading to NocoBase version 2.1.19 or later.
• Restrict access to backup management features to trusted users.
• Monitor for suspicious activity related to backup restoration.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. Additional details are available in the source references. However, the current information is limited, and defenders should verify the affected scope, severity, and vendor guidance. The vulnerability allows a backup-management user to execute commands as the NocoBase server process by restoring a crafted backup. The @nocobase/plugin-backups component of NocoBase interpolates the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.