nocodb (npm)
Advisories
54
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2026.05.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install nocodb@2026.05.1yarn
yarn add nocodb@2026.05.1pnpm
pnpm add nocodb@2026.05.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint |
Medium EPSS 0.41% |
<= 0.301.3 | No fix yet |
| GHSA-h6vv-pcq8-7xm4 NocoDB: Server-Side Request Forgery via Base Migration URL |
Medium EPSS 0.39% |
<= 0.301.3 | No fix yet |
| GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment |
Medium EPSS 0.40% |
<= 0.301.3 | No fix yet |
| GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery |
Medium EPSS 0.36% |
<= 0.301.3 | No fix yet |
| GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL |
Medium EPSS 0.39% |
<= 0.301.3 | No fix yet |
| GHSA-g72g-r7m4-9x4g NocoDB: OAuth Tokens Persist Through Security Events |
Medium EPSS 0.41% |
< 2026.05.1 | 2026.05.1 |
| GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read |
Low EPSS 0.27% |
< 2026.05.1 | 2026.05.1 |
| GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL |
High EPSS 0.40% |
< 2026.05.1 | 2026.05.1 |
| GHSA-8m7c-hf24-5g47 NocoDB: OAuth Authorization Code Race Condition |
Medium EPSS 0.26% |
< 2026.05.1 | 2026.05.1 |
| GHSA-wvqj-9wv4-7ff5 NocoDB: Path Traversal via SQLite Source Filename |
Medium EPSS 0.44% |
< 2026.05.1 | 2026.05.1 |
| GHSA-p8wx-5f39-w3x4 NocoDB: SQL Injection via Column Title in Bulk GroupBy |
Medium EPSS 0.42% |
< 2026.05.1 | 2026.05.1 |
| GHSA-jf3g-4gwg-4h66 NocoDB: Stored Cross-Site Scripting via Row Comments |
High EPSS 0.40% |
< 2026.05.1 | 2026.05.1 |
| GHSA-w43h-r5m5-p832 NocoDB: Server-Side Request Forgery via Database Connection Host |
Medium EPSS 0.35% |
< 2026.05.1 | 2026.05.1 |
| GHSA-96fh-m4r8-6v9v NocoDB: Cross-Workspace Integration Use in Connection Test |
Medium EPSS 0.43% |
< 2026.05.1 | 2026.05.1 |
| GHSA-jr54-jwhj-55gp NocoDB: User Enumeration via Sign-In Timing |
Medium EPSS 0.31% |
< 2026.04.1 | 2026.04.1 |
| GHSA-qhxg-623c-cfjm NocoDB: Plaintext Password Comparison in Shared Views |
Medium EPSS 0.43% |
< 2026.05.1 | 2026.05.1 |
| GHSA-4w6r-5c2j-qf5f NocoDB: Hidden Column Exposure in Public Shared View Endpoints |
Medium EPSS 0.41% |
< 2026.04.1 | 2026.04.1 |
| GHSA-rvp5-9p55-f5rp NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin |
Medium EPSS 0.41% |
< 2026.04.1 | 2026.04.1 |
| GHSA-6xcx-7qmg-vjfq NocoDB: Reflected Cross-Site Scripting via Password Reset Token |
Medium EPSS 0.44% |
< 2026.04.1 | 2026.04.1 |
| GHSA-cxv7-gmmp-228p NocoDB: Postgres SQL Injection in Formula `ARRAYSORT` |
Medium EPSS 0.38% |
< 2026.04.1 | 2026.04.1 |
| GHSA-9wgh-m22w-9xj8 NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints |
Medium EPSS 0.41% |
< 2026.05.1 | 2026.05.1 |
| GHSA-f76x-f9vj-92jv NocoDB: Stale Auth Cache After API Token Deletion |
Low EPSS 0.31% |
<= 0.301.3 | No fix yet |
| GHSA-8rwr-f68v-cvw6 NocoDB: Attachment Size Limit Bypass via Upload-by-URL |
Low EPSS 0.41% |
<= 0.301.3 | No fix yet |
| GHSA-chqv-vrj7-qffp NocoDB: Shared-base link access can invite arbitrary users as persistent base members |
Medium EPSS 0.31% |
<= 0.301.3 | No fix yet |
| GHSA-99vc-2jx2-688p NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion |
Medium EPSS 0.41% |
<= 0.301.3 | No fix yet |
| GHSA-f74w-272x-mqcv NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags |
Medium EPSS 0.16% |
<= 0.301.3 | No fix yet |
| GHSA-m5qg-rvjq-727p NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation |
Low EPSS 0.24% |
<= 0.301.3 | No fix yet |
| GHSA-2c5x-4jgf-88mj NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) |
Medium EPSS 0.29% |
<= 0.301.3 | No fix yet |
| GHSA-9qgr-6vpg-9gh9 NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL |
Medium EPSS 0.27% |
<= 0.301.3 | No fix yet |
| GHSA-wwp2-x4rj-j8rm NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells |
Medium EPSS 0.21% |
< 0.301.3 | 0.301.3 |
| GHSA-45rp-9p97-h852 NocoDB Vulnerable to SQL Injection via DATEADD Formula |
High EPSS 0.36% |
< 0.301.3 | 0.301.3 |
| GHSA-8vm4-g489-v3w7 NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells |
Medium EPSS 0.17% |
< 0.301.3 | 0.301.3 |
| GHSA-rcph-x7mj-54mm NocoDB Vulnerable to Stored Cross-site Scripting via Comments |
Medium EPSS 0.21% |
< 0.301.3 | 0.301.3 |
| GHSA-x4vh-j75g-268g NocoDB's Refresh Tokens Not Revoked on Password Reset |
Medium EPSS 0.21% |
< 0.301.3 | 0.301.3 |
| GHSA-p9x3-w98f-7j3q NocoDB Missing Ownership Validation in MCP Token Operations |
Medium EPSS 0.18% |
< 0.301.3 | 0.301.3 |
| GHSA-mpp2-x7wv-38hv NocoDB has Plaintext Storage of Shared View Passwords |
Medium EPSS 0.23% |
< 0.301.3 | 0.301.3 |
| GHSA-qxwq-q265-hc44 NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field |
Medium EPSS 0.18% |
< 0.301.3 | 0.301.3 |
| GHSA-387m-j3p9-3php NocoDB Vulnerable to User Enumeration via Password Reset Endpoint |
Medium EPSS 0.65% |
< 0.301.3 | 0.301.3 |
| GHSA-vx5p-q85x-xm3c NocoDB has Stored Cross-site Scripting via Formula Cell |
Medium EPSS 0.17% |
< 0.301.3 | 0.301.3 |
| GHSA-q5c6-h22r-qpwr NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload |
Critical EPSS 0.43% |
< 0.301.0 | 0.301.0 |
| GHSA-3hmw-8mw3-rmpj NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter |
Medium EPSS 0.31% |
< 0.301.0 | 0.301.0 |
| GHSA-xr7v-j379-34v9 NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality |
Medium EPSS 0.22% |
< 0.301.0 | 0.301.0 |
| GHSA-95ff-46g6-6gw9 NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS |
Medium EPSS 0.42% |
< 0.301.0 | 0.301.0 |
| GHSA-wf6c-hrhf-86cw NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page |
Medium EPSS 0.71% |
< 0.258.0 | 0.258.0 |
| GHSA-h6r4-xvw6-jc5h NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue |
High EPSS 0.61% |
< 0.202.9 | 0.202.9 |
| GHSA-8fxg-mr34-jqr8 NocoDB SQL Injection vulnerability |
Medium EPSS 0.70% |
< 0.202.10 | 0.202.10 |
| GHSA-qg73-g3cf-vhhh NocoDB Allows Preview of Files with Dangerous Content |
Medium EPSS 0.57% |
>= 0.202.6, < 0.202.10 | 0.202.10 |
| GHSA-3m5q-q39v-xf8f nocodb SQL Injection vulnerability |
Medium EPSS 0.87% |
< 0.111.0 | 0.111.0 |
| GHSA-xrpm-hccg-28x7 Improper Input Validation in nocodb |
Medium EPSS 0.77% |
< 0.96.0 | 0.96.0 |
| GHSA-grv6-m753-3w2g NocoDB vulnerable to Denial of Service |
Medium EPSS 2.29% |
< 0.92.0 | 0.92.0 |
| GHSA-hv6q-5g4f-8897 Cross-site Scripting in NocoDB |
Medium EPSS 0.71% |
< 0.91.9 | 0.91.9 |
| GHSA-mx8q-jqwm-85mv NocoDB information disclosure vulnerability |
High EPSS 1.48% |
< 0.91.7 | 0.91.7 |
| GHSA-fq4h-m3c8-8m2v Improper Privilege Management in NocoDB |
High EPSS 1.37% |
< 0.91.8 | 0.91.8 |
| GHSA-6293-2vg2-pmp5 Insufficient Session Expiration in NocoDB |
High EPSS 1.22% |
< 0.91.9 | 0.91.9 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor