Executive brief
NocoDB, a platform that turns databases into smart spreadsheets, is vulnerable to a security flaw that allows certain users to run unauthorized database commands. An attacker with permissions to create or rename columns could use a specially crafted column title to access or modify data they shouldn't see. This could lead to unauthorized data exposure or minor data manipulation within the connected database.
Technical details
A SQL injection vulnerability exists in NocoDB's bulk groupBy endpoint due to improper neutralization of user-supplied column titles. The 'group-by.ts' component utilizes 'knex.raw()' to build database aggregations, directly interpolating the 'column_name' into the SQL string. Because the column lookup logic in 'data-table.service.ts' matches against both sanitized names and free-text titles, an attacker can bypass existing allowlists by embedding SQL fragments in a column title. Exploitation requires network access and an authenticated session with 'column-create' or rename permissions. This allows for arbitrary SQL execution against the underlying database, primarily impacting data confidentiality and integrity.
Affected products
- nocodb nocodb < 2026.05.1
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-05-01: patched: Vulnerability fixed in version 2026.05.1
- 2026-06-23: disclosed: CVE published to NVD