Skip to content
OpenAdvisories

Package · npm

nocodb

54 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.4
    CVE-2026-47383

    NocoDB: Stored Cross-Site Scripting via Row Comments

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths per…

    nocodb nocodb nocodb npm
  • High 8.4
    CVE-2026-47387

    NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check…

    nocodb nocodb nocodb npm
  • High 8.5
    CVE-2026-24769

    NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded Jav…

    nocodb nocodb nocodb npm
  • High 7.3
    CVE-2023-49781

    NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

    NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with t…

    nocodb nocodb nocodb npm
  • High 7.3
    CVE-2022-3423

    Allocation of Resources Without Limits or Throttling in nocodb/nocodb

    Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.

    nocodb nocodb/nocodb nocodb npm
  • High 7.3
    CVE-2022-2079

    Cross-site Scripting (XSS) - Stored in nocodb/nocodb

    Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.

    nocodb nocodb/nocodb nocodb npm