CVE-2026-55410

### Summary NocoBase `@nocobase/plugin-backups` 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js `child_process.exec()`. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in `_metadata.json` under `database.schema`, causing arbitrary commands to execute as the NocoBase server process during restore. The vulnerable plugin is included in the default `@nocobase/preset-nocobase` package and is guarded by the backup-management ACL snippet (`backups:*` / `backup:*`). This is not unauthenticated; the attacker must have backup restore privileges or equivalent access to the restore API/CLI. ### Details Affected product evidence: - Ecosystem/package: npm package `@nocobase/plugin-backups` from `packages/plugins/@nocobase/plugin-backups/package.json`. - Tested vulnerable version: `2.0.57` (`packages/plugins/@nocobase/plugin-backups/package.json:1-16`). - Tested commit: `e03d267362b3426f484c28783020b4a2a08911e8`. - Default/common inclusion: `@nocobase/preset-nocobase` depends on and lists `@nocobase/plugin-backups` 2.0.57 as built in (`packages/presets/nocobase/package.json:22-24`, `packages/presets/nocobase/package.json:115-128`). - Affected range estimate: at least the tested `2.0.57` checkout. Earlier/later versions were not tested. - Patched version: unknown/not available in this local checkout. Source-to-sink path: - The plugin registers backup-management snippets for `backups:*` and `backup:*`, so the restore API is intended for roles granted backup-management permissions (`packages/plugins/@nocobase/plugin-backups/src/server/plugin.ts:51-59`). - The `backup` restore-upload action accepts request body/query `force` and passes it as `forceSchemaRestore` to `RestoreManager.restore()` (`packages/plugins/@nocobase/plugin-backups/src/server/resourcers/backup-cli.ts:40-42`, `packages/plugins/@nocobase/plug