nocodb@0.202.4

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the handling of secure attachments when the NC_SECURE_ATTACHMENTS setting is enabled. An attacker can execute arbitrary scripts in the context of the application by uploading specially crafted .html or .svg files that are rendered inline by the browser. This is only exploitable if the attacker has authenticated upload permissions and secure-attachment mode is enabled.

There is no fixed version for nocodb.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the migrate endpoint when a user with workspace owner role supplies a crafted migrationUrl. An attacker can access internal resources or read local files by providing a malicious URL to the endpoint. This is only exploitable if the attacker has workspace owner privileges.

There is no fixed version for nocodb.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the spreadsheet import URL check in UtilsService._axiosRequestMake in packages/nocodb/src/services/utils.service.ts. An attacker can make the server fetch an arbitrary URL by submitting a spreadsheet-import request whose target URL passes the extension allowlist, such as a non-spreadsheet path with a query string ending in .csv. Because the allowlist was applied to the full URL string instead of the URL pathname, the endpoint accepted crafted URLs that were not actually spreadsheet files. This lets an attacker coerce the NocoDB process into issuing HTTP requests on their behalf, including requests to internal services reachable from the host.

Notes

• The vulnerable endpoint was reachable without any auth gate in the advisory’s reported deployment, so any unauthenticated caller who could hit the import API could trigger the server-side fetch.
• The bypass depended on the URL being accepted as a spreadsheet by extension alone; URLs with a non-spreadsheet path but a query string like ?.csv satisfied the check.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the axiosRequestMake spreadsheet-fetch URL handling in packages/nocodb/src/services/utils.service.ts. An attacker can make the server request internal HTTP endpoints, including cloud metadata services, by supplying a crafted spreadsheet import URL whose path contains a permitted extension and bypasses the hand-rolled IP blocklist. The vulnerable code accepted spreadsheet URLs when .xls, .xlsx, .xlsm, .ods, .ots, or .csv appeared anywhere in the full URL string, so a URL such as http://169.254.169.254/credentials/.xlsx passed the gate. Because the request was made from the NocoDB process, authenticated users with editor access could reach internal network resources and exfiltrate sensitive metadata or other internal responses.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the password reset. An attacker can execute arbitrary JavaScript in the context of the application by crafting a malicious password reset link and convincing a victim to follow it. This allows the attacker to access authentication state and perform actions on behalf of the victim.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to SQL Injection via the ARRAYSORT formula argument processing in Postgres-backed deployments. An attacker can execute arbitrary SQL commands and cause significant query delays by injecting malicious input into the direction argument, which is improperly validated and embedded into a raw SQL fragment during column creation and on every subsequent record read.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Access Control Bypass via the publicMmList, publicHmList, relDataList, and nested endpoints when the show flag for a column is not properly checked. An attacker can access hidden linked records by supplying a valid share UUID and directly querying relation endpoints for columns that are not visible in the shared view.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Directory Traversal in the process that handles SQLite source filenames. An attacker can gain unauthorized access to or modify internal application data by supplying a crafted filename that points to arbitrary files accessible by the application process. This allows reading or overwriting sensitive files through standard table APIs. This is only exploitable if the attacker is authenticated and has base-create permissions.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the public shared-view endpoints, which exposed values from columns that were intended to be hidden. An attacker can access sensitive information by crafting requests that leverage the groupBy, filter, sort, or related-data list functionalities to enumerate or extract hidden column values without authentication.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the connection-test endpoint. An authenticated attacker can access internal network resources by supplying a crafted database host value when testing database connections.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the readAttachment tool. An attacker can access files in the shared storage belonging to other users by supplying a known attachment path and a valid MCP token.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to SQL Injection via the bulk groupBy. An authenticated attacker can execute arbitrary SQL commands by setting a column's title to a crafted SQL fragment, which is then interpolated into a database query without proper sanitization.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to User Impersonation via the testConnection endpoint when the integration is fetched in a bypass scope and permission checks are insufficiently scoped to the integration's workspace. An attacker can gain unauthorized access to integration configurations and potentially interact with databases using another workspace's credentials by supplying the integration ID and possessing creator or owner privileges on any base in any workspace.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Brute Force via the auth.service.ts file. An attacker can determine whether specific email addresses are registered by measuring the response time of sign-in attempts.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Information Exposure via the shared-view password check. An attacker can infer sensitive information about legacy plaintext passwords by measuring authentication response times, potentially revealing password length and prefix without prior authentication.

Note: This is only exploitable if the targeted shared view uses a password created before the bcrypt migration and the attacker can accurately time authentication responses.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Race Condition through a race condition in the OAuth token exchange. An attacker can obtain multiple valid token pairs by making concurrent requests using the same authorization code and PKCE verifier.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to revoke OAuth tokens in the revokeAllOAuthTokensByUser process after password change, reset, or recovery. An attacker can maintain unauthorized access by continuing to use previously issued OAuth tokens even after a user has performed a security event intended to invalidate such access.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Missing Authorization via the AclMiddleware in the request authorization path. An attacker can invite users or enumerate base members by sending userInvite or baseUserList requests from a shared-base session. This allows a public-link visitor to perform privileged membership operations on a base, exposing member information and enabling unwanted access to the shared workspace.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Insufficient Session Expiration through the ApiToken delete path in the token management code. An attacker can keep using a deleted API token by deleting it while the cache entry remains keyed under the token value, leaving stale authentication data available for subsequent requests.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the AttachmentsService upload-by-URL path in the attachment handling code. An attacker can exhaust storage or processing resources by providing a remote file URL pointing to a very large file. The service accepts the response metadata from the fetched URL without enforcing a file size limit, allowing oversized uploads to be pulled into the attachment workflow and disrupting normal application use.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the AttachmentsService upload-by-URL path in the attachment handling code. An attacker can exhaust storage or processing resources by providing a remote file URL pointing to a very large file. The service accepts the response metadata from the fetched URL without enforcing a file size limit, allowing oversized uploads to be pulled into the attachment workflow and disrupting normal application use.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the sendMessage methods in the Discord, Mattermost, Slack, and Teams webhook adapters. An attacker can make the server send requests to attacker-controlled URLs by supplying a webhook_url in payload.channels, causing the application to connect to arbitrary internal or external endpoints and leak request traffic through the webhook delivery path.

Workarounds

• Restrict webhook creation and editing to trusted authenticated users only, because an authenticated user with hook-creation permission can point notification.payload.channels[].webhook_url at internal or attacker-controlled hosts and trigger outbound requests through the webhook delivery path.
• Avoid enabling verbose hook logging with NC_AUTOMATION_LOG_LEVEL=ALL, because it can expose response bodies from the SSRF-triggered webhook requests and increase the amount of data an attacker can exfiltrate.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute through the setTokenCookie function in the authentication service. An attacker can steal or replay the refresh_token by intercepting it over plaintext HTTP or by inducing the browser to send it in cross-site requests. This exposes user sessions to hijacking and unauthorized access to accounts.

A fix was pushed into the master branch but not yet published.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the CommentsService component, which uses v-html without proper sanitization. An attacker can execute arbitrary JavaScript code in the context of a user's browser by submitting crafted input that is later viewed by other users.

Note:

This issue affects users of nc-gui frontend.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the v-html due to the lack of sanitization. An attacker with Editor role can execute arbitrary scripts in the context of a user's browser by storing malicious content in rich text cells.

Note:

This issue affects users of nc-gui frontend.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Comment.insert() function that that lacks sanitization for stored HTML. An attacker can execute arbitrary JavaScript code in the context of the user's browser by submitting crafted input that is later viewed by other users.

Note:

This issue affects users of nc-gui frontend.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to SQL Injection via the DATEADD formula's unit parameter. An attacker with the Creator role can execute arbitrary SQL commands by supplying crafted input to this parameter.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the CommentsService component that lacks sanitization for stored HTML. An attacker can execute arbitrary scripts in the context of users viewing affected rich text fields by injecting unsanitized HTML through the API.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the McpTokenService.get(), regenerateToken(), and delete() functions due to missing ownership validation for MCP tokens. An attacker with Creator role privileges can access, regenerate, or delete another user's tokens by knowing the target token ID.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Insufficient Session Expiration in the passwordReset() function that fails to call UserRefreshToken.deleteAllUserToken() to invalidate JWTs. An attacker can maintain unauthorized access by using a previously obtained refresh token to mint valid JWTs even after the victim resets their password.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Information Exposure via the POST /api/v2/auth/password/forgot endpoint. An attacker can determine whether a specific email address is registered by submitting password reset requests and analyzing the differing responses.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Credential Exposure in the password column of the nc_views table in public-datas.service.ts, public-metas.service.ts and calendar-datas.service.ts, where passwords are stored in plaintext. An attacker can obtain sensitive authentication credentials by gaining unauthorized access to the database.

Upgrade nocodb to version 0.301.3 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Open Redirect via the continueAfterSignIn parameter during the authentication process. An attacker can redirect authenticated users to arbitrary external websites by supplying a crafted value, increasing the risk of credential theft through social engineering.

Upgrade nocodb to version 0.301.0 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the SVG upload. An attacker can execute arbitrary JavaScript in the browsers of other users by uploading a crafted SVG file containing embedded scripts, which are rendered inline when viewed.

Upgrade nocodb to version 0.301.0 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge() function in utils/dataUtils.ts file. An attacker can cause all database write operations to fail application-wide until the server is restarted by sending crafted requests to this endpoint.

Note: This is only exploitable if the attacker is an authenticated user with org-level-creator permissions.

Upgrade nocodb to version 0.301.0 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the uploadViaURL function in the attachments.service.ts file. An attacker can trigger outbound requests to arbitrary URLs by supplying crafted input to the process before validation is enforced.

Upgrade nocodb to version 0.301.0 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the password reset API endpoint /api/v1/db/auth/password/reset/. An attacker can execute scripts in the context of the user's browser session by convincing the user to follow a malicious link.

Upgrade nocodb to version 0.258.0 or higher.

nocodb is a NocoDB

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the replaceUrlsWithLink function. An attacker can execute arbitrary JavaScript code by embedding malicious content within the formula fields that are improperly sanitized before being displayed.

Upgrade nocodb to version 0.202.9 or higher.