Package Instance

NocoDB Vulnerable to SQL Injection via DATEADD Formula
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.

NocoDB Vulnerable to Stored Cross-site Scripting via Comments
Comments rendered via `v-html` without sanitization, enabling stored XSS.

NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
A **blind Server-Side Request Forgery (SSRF)** vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation.

This allows limited outbound requests to arbitrary URLs before SSRF controls are applied.

---

NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API.

NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
Rich text cell content rendered via `v-html` without sanitization, enabling stored XSS.

NocoDB has Plaintext Storage of Shared View Passwords
Shared view passwords were stored in plaintext in the database and compared using direct string equality.

NocoDB Vulnerable to User Enumeration via Password Reset Endpoint
The password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration.

NocoDB Missing Ownership Validation in MCP Token Operations
The MCP token service did not validate token ownership, allowing a Creator within the same base to read, regenerate, or delete another user's MCP tokens if the token ID was known.

NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
User-controlled content in comments and rich text cells was rendered via `v-html` without sanitization, enabling stored XSS.

NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
An **unvalidated redirect (open redirect)** vulnerability exists in NocoDB’s login flow due to missing validation of the `continueAfterSignIn` parameter.

During authentication, NocoDB processes a user-controlled redirect value and conditionally performs client-side navigation without enforcing any restrictions on the destination’s origin, domain or protocol. This allows attackers to redirect authenticated users to arbitrary external websites after login.

NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS
An authenticated user with org-level-creator permissions can exploit prototype pollution in the `/api/v2/meta/connection/test` endpoint, causing all database write operations to fail application-wide until server restart.

While the pollution technically bypasses SUPER_ADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution.

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
A **stored Cross-site Scripting (XSS)** vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment.

Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.

---

NocoDB's Refresh Tokens Not Revoked on Password Reset
The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.

NocoDB has Stored Cross-site Scripting via Formula Cell
A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing `URI::()` patterns are rendered via `v-html` without sanitization, allowing injected HTML to execute.

NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Scripting.