CSV Injection Affecting nocodb package, versions >=0.81.0 <0.84.1
Threat Intelligence
EPSS
0.1% (42nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NOCODB-2332047
- published 12 Jan 2022
- disclosed 11 Jan 2022
- credit Unknown
Introduced: 11 Jan 2022
CVE-2022-22121 Open this link in a new tabHow to fix?
Upgrade nocodb to version 0.84.1 or higher.
Overview
nocodb is a NocoDB
Affected versions of this package are vulnerable to CSV Injection via payloads injected to table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.
References
CVSS Scores
version 3.1