{"action":"Upgrade @nocobase/plugin-backups to 2.1.19 or later.","affected":[{"fixed":"2.1.19","introduced":"0"}],"component":"@nocobase/plugin-backups","cve_ids":["CVE-2026-55410"],"ecosystem":"npm","epss":0.00721,"exploited":false,"fixed_versions":["2.1.19"],"ghsa_id":"GHSA-p853-83gj-wjj3","id":"tcs_01M5KG310B7F6HKZ00BAE2C8Q3","modified_at":"2026-08-20T18:45:17.584926118Z","published_at":"2026-08-20T18:30:15Z","references":["https://osv.dev/vulnerability/GHSA-p853-83gj-wjj3","https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3","https://nvd.nist.gov/vuln/detail/CVE-2026-55410","https://github.com/nocobase/nocobase/commit/0e1aba1b7b112ffc841588963f7343c00edd9806","https://github.com/nocobase/nocobase","https://github.com/nocobase/nocobase/releases/tag/v2.1.19"],"severity":{"label":"medium","score":6.7},"sources":[{"source":"osv","source_id":"GHSA-p853-83gj-wjj3","url":"https://osv.dev/vulnerability/GHSA-p853-83gj-wjj3"}],"summary":"NocoBase backup restore schema name allows command injection"}