Technical impact
The vulnerability stems from unsafe interpolation of the database.schema value from a _metadata.json file into a shell command string that is executed with Node.js child_process.exec(). According to the advisory, any backup-management user who restores a crafted backup can inject and execute arbitrary commands as the NocoBase server process. This leads to a full compromise of confidentiality, integrity and availability on the host running the service, since the injected commands run with the same privileges as the application. The weakness is a classic command injection flaw (CWE-78).
Affected Systems
All instances of NocoBase that use the @nocobase/plugin-backups package and are running a version earlier than 2.1.19 are affected. The vulnerability applies to the nocobase product supplied by the vendor NocoBase.
Risk and Exploitability
The CVSS score of 6.7 indicates a medium severity. The EPSS score is reported as < 1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a backup-management user who triggers a restore operation; therefore, it is likely that authenticated privilege is a prerequisite. Once the injection is triggered, the attacker can execute arbitrary shell commands as the server process. Given the low EPSS and no public exploits, the risk is moderate but the potential impact is high if the server runs with elevated privileges.
Github GHSA