- Latest release
- 0.301.3 (Feb 27, 2026): affected by 29 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 54 · 3 critical, 6 high, 39 medium, 6 low
- Weekly downloads
- 6,926
- Dependents
- 0
- Releases
- 295 since 0.0.1 (Dec 29, 2020)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-46547Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-46548Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-46549Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-46550Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-46552Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-46553Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47375Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47376Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47377Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47378Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47380Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-46551Affects 0.0.1 to 0.301.3 (through the newest release)
Show all 54 advisoriesShow fewer advisories
- CVE-2026-46554Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47382Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47279Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47379Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47381Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47383Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47384Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47385Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47386Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47387Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-47388Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-53926Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-53927Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-53928Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-53929Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-53930Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-53931Affects 0.0.1 to 0.301.3 (through the newest release)
- CVE-2026-28401Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28399Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28398Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28397Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28396Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28361Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28360Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28359Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28358Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-28357Affects 0.0.1 to 0.301.2 (0.301.3 is outside it)
- CVE-2026-24769Affects 0.0.1 to 0.300.0 (0.301.0 is outside it)
- CVE-2026-24768Affects 0.0.1 to 0.300.0 (0.301.0 is outside it)
- CVE-2026-24767Affects 0.0.1 to 0.300.0 (0.301.0 is outside it)
- CVE-2026-24766Affects 0.0.1 to 0.300.0 (0.301.0 is outside it)
- CVE-2025-27506Affects 0.0.1 to 0.257.2 (0.258.0 is outside it)
- CVE-2023-49781Affects 0.0.1 to 0.202.8 (0.202.9 is outside it)
- CVE-2023-50718Affects 0.0.1 to 0.202.9 (0.202.10 is outside it)
- CVE-2023-50717Affects 0.202.6 to 0.202.9 (0.202.10 is outside it)
- CVE-2023-43794Affects 0.0.1 to 0.109.7 (0.111.0 is outside it)
- CVE-2023-5104Affects 0.0.1 to 0.92.4 (0.96.0 is outside it)
- CVE-2022-3423Affects 0.0.1 to 0.91.10 (0.92.0 is outside it)
- CVE-2022-2079Affects 0.0.1 to 0.91.8 (0.91.9 is outside it)
- CVE-2022-2064Affects 0.0.1 to 0.91.8 (0.91.9 is outside it)
- CVE-2022-2063Affects 0.0.1 to 0.91.7 (0.91.8 is outside it)
- CVE-2022-2062Affects 0.0.1 to 0.91.6 (0.91.7 is outside it)
Advisories 54
- CVE-2026-46547Medium 6.1
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46548Medium 4.3
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46549Low 2.0
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46550Medium 5.4
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46552Medium 5.8
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46553Low 2.1
NocoDB: Attachment Size Limit Bypass via Upload-by-URL
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47375Medium 6.0
NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
Affected: fixed in 2026.04.1.
No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47376Medium 5.1
NocoDB: Reflected Cross-Site Scripting via Password Reset Token
Affected: fixed in 2026.04.1.
No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47377Medium 5.1
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
Affected: fixed in 2026.04.1.
No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47378Medium 6.9
NocoDB: Hidden Column Exposure in Public Shared View Endpoints
Affected: fixed in 2026.04.1.
No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47380Medium 6.3
NocoDB: User Enumeration via Sign-In Timing
Affected: fixed in 2026.04.1.
No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46551Medium 6.5
NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-46554Low 2.3
NocoDB: Stale Auth Cache After API Token Deletion
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47382Medium 5.3
NocoDB: Server-Side Request Forgery via Database Connection Host
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47279Medium 6.9
NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
Show all 54 advisoriesShow fewer advisories
- CVE-2026-47379Medium 6.9
NocoDB: Plaintext Password Comparison in Shared Views
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47381Medium 6.9
NocoDB: Cross-Workspace Integration Use in Connection Test
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47383High 7.4
NocoDB: Stored Cross-Site Scripting via Row Comments
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47384Medium 5.3
NocoDB: SQL Injection via Column Title in Bulk GroupBy
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47385Medium 5.3
NocoDB: Path Traversal via SQLite Source Filename
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47386Medium 6.3
NocoDB: OAuth Authorization Code Race Condition
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47387High 8.4
NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-47388Low 2.3
NocoDB: Missing Ownership Check in MCP Attachment Read
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-53926Medium 6.3
NocoDB: OAuth Tokens Persist Through Security Events
Affected: fixed in 2026.05.1.
No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-53927Medium 5.1
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-53928Medium 6.3
NocoDB: Refresh Tokens Persist Through Password Recovery
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-53929Medium 5.1
NocoDB: Stored Cross-Site Scripting via Secure Attachment
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-53930Medium 5.1
NocoDB: Server-Side Request Forgery via Base Migration URL
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-53931Medium 6.9
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
Affected: through 0.301.3.
No fix released. The latest release, 0.301.3, is still affected.
100% of nocodb downloads last week were affected versions (14.4K).
- CVE-2026-28401Medium 5.3
NocoDB: Stored Cross-Site Scripting via Rich Text Cells
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28399Medium 6.2
NocoDB: SQL Injection via DATEADD Formula
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28398Medium 5.3
NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28397Medium 5.3
NocoDB: Stored Cross-Site Scripting via Comments
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28396Medium 4.9
NocoDB: Refresh Tokens Not Revoked on Password Reset
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28361Medium 4.9
NocoDB: Missing Ownership Validation in MCP Token Operations
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28360Low 2.7
NocoDB: Plaintext Storage of Shared View Passwords
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28359Medium 5.3
NocoDB: Stored Cross-Site Scripting via Rich Text Field
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28358Low 2.7
NocoDB: User Enumeration via Password Reset Endpoint
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-28357Medium 5.3
NocoDB: Stored Cross-Site Scripting via Formula Cell
Affected: fixed in 0.301.3.
Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure).
The latest release, 0.301.3, is not affected.
91% of nocodb downloads last week were affected versions (13.1K).
- CVE-2026-24769High 8.5
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
Affected: fixed in 0.301.0.
Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure).
The latest release, 0.301.3, is not affected.
89% of nocodb downloads last week were affected versions (12.8K).
- CVE-2026-24768Medium 5.7
NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter
Affected: fixed in 0.301.0.
Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure).
The latest release, 0.301.3, is not affected.
89% of nocodb downloads last week were affected versions (12.8K).
- CVE-2026-24767Medium 4.9
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
Affected: fixed in 0.301.0.
Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure).
The latest release, 0.301.3, is not affected.
89% of nocodb downloads last week were affected versions (12.8K).
- CVE-2026-24766Medium 4.9
NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS
Affected: fixed in 0.301.0.
Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure).
The latest release, 0.301.3, is not affected.
89% of nocodb downloads last week were affected versions (12.8K).
- CVE-2025-27506Medium 5.4
NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page
Affected: fixed in 0.258.0.
Fixed in 0.258.0 (released Nov 12, 2024, 114 days before disclosure).
The latest release, 0.301.3, is not affected.
64% of nocodb downloads last week were affected versions (9.3K).
- CVE-2023-49781High 7.3
NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue
Affected: fixed in 0.202.9.
Fixed in 0.202.9 (released Nov 30, 2023, 165 days before disclosure).
The latest release, 0.301.3, is not affected.
48% of nocodb downloads last week were affected versions (7K).
- CVE-2023-50718Medium 6.5
NocoDB SQL Injection vulnerability
Affected: fixed in 0.202.10.
Fixed in 0.202.10 (released Dec 13, 2023, 152 days before disclosure).
The latest release, 0.301.3, is not affected.
49% of nocodb downloads last week were affected versions (7K).
- CVE-2023-50717Medium 5.7
NocoDB Allows Preview of File with Dangerous Content
Affected: from 0.202.6, fixed in 0.202.10.
Fixed in 0.202.10 (released Dec 13, 2023, 152 days before disclosure).
The latest release, 0.301.3, is not affected.
1.7% of nocodb downloads last week were affected versions (245).
- CVE-2023-43794Medium 6.5
SQL Injection in nocodb
Affected: fixed in 0.111.0.
Fixed in 0.111.0 (released Aug 25, 2023, 53 days before disclosure).
The latest release, 0.301.3, is not affected.
43% of nocodb downloads last week were affected versions (6.3K).
- CVE-2023-5104Medium 5.7
Improper Input Validation in nocodb/nocodb
Affected: fixed in 0.96.0.
Fixed in 0.96.0 (released Sep 7, 2022, 379 days before disclosure).
The latest release, 0.301.3, is not affected.
29% of nocodb downloads last week were affected versions (4.1K).
- CVE-2022-3423High 7.3
Allocation of Resources Without Limits or Throttling in nocodb/nocodb
Affected: fixed in 0.92.0.
Fixed in 0.92.0 (released Jun 28, 2022, 101 days before disclosure).
The latest release, 0.301.3, is not affected.
28% of nocodb downloads last week were affected versions (4K).
- CVE-2022-2079High 7.3
Cross-site Scripting (XSS) - Stored in nocodb/nocodb
Affected: fixed in 0.91.9.
Fixed in 0.91.9 (released Jun 14, 2022, the day of disclosure).
The latest release, 0.301.3, is not affected.
27% of nocodb downloads last week were affected versions (3.9K).
- CVE-2022-2064Critical 9.1
Insufficient Session Expiration in nocodb/nocodb
Affected: fixed in 0.91.9.
Fixed in 0.91.9 (released Jun 14, 2022, 1 day after disclosure).
The latest release, 0.301.3, is not affected.
27% of nocodb downloads last week were affected versions (3.9K).
- CVE-2022-2063Critical 9.0
Improper Privilege Management in nocodb/nocodb
Affected: fixed in 0.91.8.
Fixed in 0.91.8 (released Jun 14, 2022, 1 day after disclosure).
The latest release, 0.301.3, is not affected.
27% of nocodb downloads last week were affected versions (3.8K).
- CVE-2022-2062Critical 9.1
Generation of Error Message Containing Sensitive Information in nocodb/nocodb
Affected: fixed in 0.91.7.
Fixed in 0.91.7 (released Jun 1, 2022, 12 days before disclosure).
The latest release, 0.301.3, is not affected.
26% of nocodb downloads last week were affected versions (3.8K).