Skip to content
OpenAdvisories

Vendor

nocodb

60 known vulnerabilities.

Products

nocodb 52 nocodb/nocodb 8
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.4
    CVE-2026-47383

    NocoDB: Stored Cross-Site Scripting via Row Comments

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths per…

    nocodb nocodb nocodb npm
  • High 8.4
    CVE-2026-47387

    NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

    NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check…

    nocodb nocodb nocodb npm
  • High 8.5
    CVE-2026-24769

    NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded Jav…

    nocodb nocodb nocodb npm
  • High 7.3
    CVE-2023-49781

    NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

    NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with t…

    nocodb nocodb nocodb npm
  • High 7.3
    CVE-2022-3423

    Allocation of Resources Without Limits or Throttling in nocodb/nocodb

    Allocation of Resources Without Limits or Throttling in GitHub repository nocodb/nocodb prior to 0.92.0.

    nocodb nocodb/nocodb nocodb npm
  • High 7.3
    CVE-2022-2079

    Cross-site Scripting (XSS) - Stored in nocodb/nocodb

    Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7+.

    nocodb nocodb/nocodb nocodb npm
  • High 8.0
    CVE-2022-22121

    NocoDB - CSV Injection in User Management

    In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and e…

    nocodb nocodb