NocoBase backup restore schema name allows command injection
NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js child_process.exec(). A backup-management user who can restore an uploaded PostgreSQL backup with forced schema restore can place shell metacharacters in _metadata.json under database.schema, causing arbitrary commands to execute as the NocoBase server process during restore. The vulnerable plugin is included in the default @nocobase/preset-nocobase package and is guarded …