NocoDB vulnerabilities
We track 20 vulnerabilities in NocoDB products across 2 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest NocoDB vulnerabilities
- 8.8 High severity
nocodb: Improper Neutralization of Special Elements used in an SQL Command
NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email wi
- 8.1 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted
- 7.7 High severity
nocodb: Improper Neutralization of Special Elements used in an SQL Command
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into f
- 8.8 High severity
nocodb: Incorrect Authorization
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete recor
- 8.0 High severity
nocodb: Improper Privilege Management
NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read,
- 7.4 High severity
nocodb: Concurrent Execution using Shared Resource with Improper Synchronization
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the l
- 7.5 High severity
nocodb: Concurrent Execution using Shared Resource with Improper Synchronization
NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt ha
- 7.5 High severity
nocodb: Allocation of Resources Without Limits or Throttling
NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a
- 7.1 High severity
nocodb: Authorization Bypass Through User-Controlled Key
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read privat
- 8.7 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped in
- 8.1 High severity
nocodb: Improper Privilege Management
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on
- 7.7 High severity
nocodb: Insufficiently Protected Credentials
NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers re
- 8.7 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so t
- 8.4 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check
- 7.4 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths pers
- 8.8 High severity
nocodb: Improper Neutralization of Special Elements used in an SQL Command
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.
- 9.0 Critical severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded Java
- 7.6 High severity
nocodb: Improper Neutralization of Input During Web Page Generation
NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with th
- 7.5 High severity
Nocodb: Improper Limitation of a Pathname to a Restricted Directory
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to access arbitrary files on the server by manipulating the path parameter of the /download route. This vulnerability could allow an attacker to acce
- 7.5 High severity
nocodb/nocodb: Server-Side Request Forgery
With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack can lead to leak of sensitive information.