# nocodb (npm) vulnerabilities 54 known vulnerabilities (3 critical, 6 high, 39 medium, 6 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.301.3 (Feb 27, 2026): affected by 29 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 6,926 - Dependents: 0 - Releases: 295 since 0.0.1 (Dec 29, 2020) - Registry: https://www.npmjs.com/package/nocodb - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-46547: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46548: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46549: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46550: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46552: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46553: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47375: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47376: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47377: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47378: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47380: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46551: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-46554: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47382: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47279: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47379: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47381: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47383: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47384: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47385: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47386: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47387: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-47388: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-53926: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-53927: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-53928: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-53929: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-53930: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-53931: 0.0.1 to 0.301.3 (through the newest release) - CVE-2026-28401: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28399: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28398: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28397: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28396: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28361: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28360: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28359: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28358: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-28357: 0.0.1 to 0.301.2 (0.301.3 is outside it) - CVE-2026-24769: 0.0.1 to 0.300.0 (0.301.0 is outside it) - CVE-2026-24768: 0.0.1 to 0.300.0 (0.301.0 is outside it) - CVE-2026-24767: 0.0.1 to 0.300.0 (0.301.0 is outside it) - CVE-2026-24766: 0.0.1 to 0.300.0 (0.301.0 is outside it) - CVE-2025-27506: 0.0.1 to 0.257.2 (0.258.0 is outside it) - CVE-2023-49781: 0.0.1 to 0.202.8 (0.202.9 is outside it) - CVE-2023-50718: 0.0.1 to 0.202.9 (0.202.10 is outside it) - CVE-2023-50717: 0.202.6 to 0.202.9 (0.202.10 is outside it) - CVE-2023-43794: 0.0.1 to 0.109.7 (0.111.0 is outside it) - CVE-2023-5104: 0.0.1 to 0.92.4 (0.96.0 is outside it) - CVE-2022-3423: 0.0.1 to 0.91.10 (0.92.0 is outside it) - CVE-2022-2079: 0.0.1 to 0.91.8 (0.91.9 is outside it) - CVE-2022-2064: 0.0.1 to 0.91.8 (0.91.9 is outside it) - CVE-2022-2063: 0.0.1 to 0.91.7 (0.91.8 is outside it) - CVE-2022-2062: 0.0.1 to 0.91.6 (0.91.7 is outside it) ## Advisories (54) ### [CVE-2026-46547](https://cve.now/CVE-2026-46547): NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL - Severity: Medium 6.1 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46548](https://cve.now/CVE-2026-46548): NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) - Severity: Medium 4.3 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46549](https://cve.now/CVE-2026-46549): NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation - Severity: Low 2.0 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46550](https://cve.now/CVE-2026-46550): NocoDB: Refresh Token Cookie Set Without \`Secure\` and \`SameSite\` Flags - Severity: Medium 5.4 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46552](https://cve.now/CVE-2026-46552): NocoDB: Shared-base link access can invite arbitrary users as persistent base members - Severity: Medium 5.8 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46553](https://cve.now/CVE-2026-46553): NocoDB: Attachment Size Limit Bypass via Upload-by-URL - Severity: Low 2.1 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47375](https://cve.now/CVE-2026-47375): NocoDB: Postgres SQL Injection in Formula \`ARRAYSORT\` - Severity: Medium 6.0 - Published: Jun 23, 2026 - Affected: fixed in 2026.04.1. - No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47376](https://cve.now/CVE-2026-47376): NocoDB: Reflected Cross-Site Scripting via Password Reset Token - Severity: Medium 5.1 - Published: Jun 23, 2026 - Affected: fixed in 2026.04.1. - No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47377](https://cve.now/CVE-2026-47377): NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin - Severity: Medium 5.1 - Published: Jun 23, 2026 - Affected: fixed in 2026.04.1. - No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47378](https://cve.now/CVE-2026-47378): NocoDB: Hidden Column Exposure in Public Shared View Endpoints - Severity: Medium 6.9 - Published: Jun 23, 2026 - Affected: fixed in 2026.04.1. - No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47380](https://cve.now/CVE-2026-47380): NocoDB: User Enumeration via Sign-In Timing - Severity: Medium 6.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.04.1. - No fix released. The advisory names 2026.04.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46551](https://cve.now/CVE-2026-46551): NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion - Severity: Medium 6.5 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-46554](https://cve.now/CVE-2026-46554): NocoDB: Stale Auth Cache After API Token Deletion - Severity: Low 2.3 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47382](https://cve.now/CVE-2026-47382): NocoDB: Server-Side Request Forgery via Database Connection Host - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47279](https://cve.now/CVE-2026-47279): NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints - Severity: Medium 6.9 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47379](https://cve.now/CVE-2026-47379): NocoDB: Plaintext Password Comparison in Shared Views - Severity: Medium 6.9 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47381](https://cve.now/CVE-2026-47381): NocoDB: Cross-Workspace Integration Use in Connection Test - Severity: Medium 6.9 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47383](https://cve.now/CVE-2026-47383): NocoDB: Stored Cross-Site Scripting via Row Comments - Severity: High 7.4 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47384](https://cve.now/CVE-2026-47384): NocoDB: SQL Injection via Column Title in Bulk GroupBy - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47385](https://cve.now/CVE-2026-47385): NocoDB: Path Traversal via SQLite Source Filename - Severity: Medium 5.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47386](https://cve.now/CVE-2026-47386): NocoDB: OAuth Authorization Code Race Condition - Severity: Medium 6.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47387](https://cve.now/CVE-2026-47387): NocoDB: Stored Cross-Site Scripting via Form View Redirect URL - Severity: High 8.4 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-47388](https://cve.now/CVE-2026-47388): NocoDB: Missing Ownership Check in MCP Attachment Read - Severity: Low 2.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-53926](https://cve.now/CVE-2026-53926): NocoDB: OAuth Tokens Persist Through Security Events - Severity: Medium 6.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.05.1. - No fix released. The advisory names 2026.05.1 as the fix, which the registry doesn't have yet. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-53927](https://cve.now/CVE-2026-53927): NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL - Severity: Medium 5.1 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-53928](https://cve.now/CVE-2026-53928): NocoDB: Refresh Tokens Persist Through Password Recovery - Severity: Medium 6.3 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-53929](https://cve.now/CVE-2026-53929): NocoDB: Stored Cross-Site Scripting via Secure Attachment - Severity: Medium 5.1 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-53930](https://cve.now/CVE-2026-53930): NocoDB: Server-Side Request Forgery via Base Migration URL - Severity: Medium 5.1 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-53931](https://cve.now/CVE-2026-53931): NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint - Severity: Medium 6.9 - Published: Jun 23, 2026 - Affected: through 0.301.3. - No fix released. The latest release, 0.301.3, is still affected. - 100% of nocodb downloads last week were affected versions (14.4K). ### [CVE-2026-28401](https://cve.now/CVE-2026-28401): NocoDB: Stored Cross-Site Scripting via Rich Text Cells - Severity: Medium 5.3 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28399](https://cve.now/CVE-2026-28399): NocoDB: SQL Injection via DATEADD Formula - Severity: Medium 6.2 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28398](https://cve.now/CVE-2026-28398): NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells - Severity: Medium 5.3 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28397](https://cve.now/CVE-2026-28397): NocoDB: Stored Cross-Site Scripting via Comments - Severity: Medium 5.3 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28396](https://cve.now/CVE-2026-28396): NocoDB: Refresh Tokens Not Revoked on Password Reset - Severity: Medium 4.9 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28361](https://cve.now/CVE-2026-28361): NocoDB: Missing Ownership Validation in MCP Token Operations - Severity: Medium 4.9 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28360](https://cve.now/CVE-2026-28360): NocoDB: Plaintext Storage of Shared View Passwords - Severity: Low 2.7 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28359](https://cve.now/CVE-2026-28359): NocoDB: Stored Cross-Site Scripting via Rich Text Field - Severity: Medium 5.3 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28358](https://cve.now/CVE-2026-28358): NocoDB: User Enumeration via Password Reset Endpoint - Severity: Low 2.7 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-28357](https://cve.now/CVE-2026-28357): NocoDB: Stored Cross-Site Scripting via Formula Cell - Severity: Medium 5.3 - Published: Mar 2, 2026 - Affected: fixed in 0.301.3. - Fixed in 0.301.3 (released Feb 27, 2026, 3 days before disclosure). - The latest release, 0.301.3, is not affected. - 91% of nocodb downloads last week were affected versions (13.1K). ### [CVE-2026-24769](https://cve.now/CVE-2026-24769): NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload - Severity: High 8.5 - Published: Jan 28, 2026 - Affected: fixed in 0.301.0. - Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure). - The latest release, 0.301.3, is not affected. - 89% of nocodb downloads last week were affected versions (12.8K). ### [CVE-2026-24768](https://cve.now/CVE-2026-24768): NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter - Severity: Medium 5.7 - Published: Jan 28, 2026 - Affected: fixed in 0.301.0. - Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure). - The latest release, 0.301.3, is not affected. - 89% of nocodb downloads last week were affected versions (12.8K). ### [CVE-2026-24767](https://cve.now/CVE-2026-24767): NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality - Severity: Medium 4.9 - Published: Jan 28, 2026 - Affected: fixed in 0.301.0. - Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure). - The latest release, 0.301.3, is not affected. - 89% of nocodb downloads last week were affected versions (12.8K). ### [CVE-2026-24766](https://cve.now/CVE-2026-24766): NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS - Severity: Medium 4.9 - Published: Jan 28, 2026 - Affected: fixed in 0.301.0. - Fixed in 0.301.0 (released Jan 13, 2026, 15 days before disclosure). - The latest release, 0.301.3, is not affected. - 89% of nocodb downloads last week were affected versions (12.8K). ### [CVE-2025-27506](https://cve.now/CVE-2025-27506): NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page - Severity: Medium 5.4 - Published: Mar 6, 2025 - Affected: fixed in 0.258.0. - Fixed in 0.258.0 (released Nov 12, 2024, 114 days before disclosure). - The latest release, 0.301.3, is not affected. - 64% of nocodb downloads last week were affected versions (9.3K). ### [CVE-2023-49781](https://cve.now/CVE-2023-49781): NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue - Severity: High 7.3 - Published: May 13, 2024 - Affected: fixed in 0.202.9. - Fixed in 0.202.9 (released Nov 30, 2023, 165 days before disclosure). - The latest release, 0.301.3, is not affected. - 48% of nocodb downloads last week were affected versions (7K). ### [CVE-2023-50718](https://cve.now/CVE-2023-50718): NocoDB SQL Injection vulnerability - Severity: Medium 6.5 - Published: May 13, 2024 - Affected: fixed in 0.202.10. - Fixed in 0.202.10 (released Dec 13, 2023, 152 days before disclosure). - The latest release, 0.301.3, is not affected. - 49% of nocodb downloads last week were affected versions (7K). ### [CVE-2023-50717](https://cve.now/CVE-2023-50717): NocoDB Allows Preview of File with Dangerous Content - Severity: Medium 5.7 - Published: May 13, 2024 - Affected: from 0.202.6, fixed in 0.202.10. - Fixed in 0.202.10 (released Dec 13, 2023, 152 days before disclosure). - The latest release, 0.301.3, is not affected. - 1.7% of nocodb downloads last week were affected versions (245). ### [CVE-2023-43794](https://cve.now/CVE-2023-43794): SQL Injection in nocodb - Severity: Medium 6.5 - Published: Oct 17, 2023 - Affected: fixed in 0.111.0. - Fixed in 0.111.0 (released Aug 25, 2023, 53 days before disclosure). - The latest release, 0.301.3, is not affected. - 43% of nocodb downloads last week were affected versions (6.3K). ### [CVE-2023-5104](https://cve.now/CVE-2023-5104): Improper Input Validation in nocodb/nocodb - Severity: Medium 5.7 - Published: Sep 21, 2023 - Affected: fixed in 0.96.0. - Fixed in 0.96.0 (released Sep 7, 2022, 379 days before disclosure). - The latest release, 0.301.3, is not affected. - 29% of nocodb downloads last week were affected versions (4.1K). ### [CVE-2022-3423](https://cve.now/CVE-2022-3423): Allocation of Resources Without Limits or Throttling in nocodb/nocodb - Severity: High 7.3 - Published: Oct 7, 2022 - Affected: fixed in 0.92.0. - Fixed in 0.92.0 (released Jun 28, 2022, 101 days before disclosure). - The latest release, 0.301.3, is not affected. - 28% of nocodb downloads last week were affected versions (4K). ### [CVE-2022-2079](https://cve.now/CVE-2022-2079): Cross-site Scripting (XSS) - Stored in nocodb/nocodb - Severity: High 7.3 - Published: Jun 14, 2022 - Affected: fixed in 0.91.9. - Fixed in 0.91.9 (released Jun 14, 2022, the day of disclosure). - The latest release, 0.301.3, is not affected. - 27% of nocodb downloads last week were affected versions (3.9K). ### [CVE-2022-2064](https://cve.now/CVE-2022-2064): Insufficient Session Expiration in nocodb/nocodb - Severity: Critical 9.1 - Published: Jun 13, 2022 - Affected: fixed in 0.91.9. - Fixed in 0.91.9 (released Jun 14, 2022, 1 day after disclosure). - The latest release, 0.301.3, is not affected. - 27% of nocodb downloads last week were affected versions (3.9K). ### [CVE-2022-2063](https://cve.now/CVE-2022-2063): Improper Privilege Management in nocodb/nocodb - Severity: Critical 9.0 - Published: Jun 13, 2022 - Affected: fixed in 0.91.8. - Fixed in 0.91.8 (released Jun 14, 2022, 1 day after disclosure). - The latest release, 0.301.3, is not affected. - 27% of nocodb downloads last week were affected versions (3.8K). ### [CVE-2022-2062](https://cve.now/CVE-2022-2062): Generation of Error Message Containing Sensitive Information in nocodb/nocodb - Severity: Critical 9.1 - Published: Jun 13, 2022 - Affected: fixed in 0.91.7. - Fixed in 0.91.7 (released Jun 1, 2022, 12 days before disclosure). - The latest release, 0.301.3, is not affected. - 26% of nocodb downloads last week were affected versions (3.8K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/nocodb Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.