Description
NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nocodb | nocodb | < 2026.06.2 | 2026.06.2 |
References
- GitHub Security Advisory (GHSA-8qgc-rxmx-p7cw) vendor-advisory
- VulnCheck Advisory: NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query third-party-advisory