CVE-2026-55410

6.7 Moyenne

Publiée le 15/07/2026 à 23:16 · Modifiée le 18/07/2026 à 04:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from _metadata.json into shell command strings executed with Node.js child_process.exec(), allowing a backup-management user restoring a crafted backup to execute commands as the NocoBase server process. This vulnerability is fixed in 2.1.19.

Traduire en français

Produits concernés

nocobase

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.7 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/nocobase/nocobase/commit/0e1aba1b7b112ffc841588963f7343c00edd9806
https://github.com/nocobase/nocobase/releases/tag/v2.1.19
https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3
https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories