npm

nocodb

54 Total advisories

54 Vulnerabilities

0 Malware

Dependency scanning

Check whether nocodb is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

nocodb

Vulnerabilities

NocoDB's Refresh Tokens Not Revoked on Password Reset

NocoDB has Plaintext Storage of Shared View Passwords

NocoDB Missing Ownership Validation in MCP Token Operations

NocoDB Vulnerable to SQL Injection via DATEADD Formula

NocoDB Allows Preview of Files with Dangerous Content

NocoDB SQL Injection vulnerability

nocodb SQL Injection vulnerability

NocoDB: Missing Ownership Check in MCP Attachment Read

NocoDB: Path Traversal via SQLite Source Filename

NocoDB: Server-Side Request Forgery via Database Connection Host

NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin

NocoDB: Refresh Tokens Persist Through Password Recovery

NocoDB: Plaintext Password Comparison in Shared Views

NocoDB: SQL Injection via Column Title in Bulk GroupBy

NocoDB: User Enumeration via Sign-In Timing

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation

NocoDB: Stale Auth Cache After API Token Deletion

NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags

NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL

NocoDB: Shared-base link access can invite arbitrary users as persistent base members

NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion

NocoDB: Attachment Size Limit Bypass via Upload-by-URL

NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)

NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL

NocoDB: Server-Side Request Forgery via Base Migration URL

NocoDB: OAuth Tokens Persist Through Security Events

NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints

NocoDB: Cross-Workspace Integration Use in Connection Test

NocoDB: OAuth Authorization Code Race Condition

NocoDB: Stored Cross-Site Scripting via Row Comments

NocoDB: Reflected Cross-Site Scripting via Password Reset Token

NocoDB: Stored Cross-Site Scripting via Secure Attachment

NocoDB: Hidden Column Exposure in Public Shared View Endpoints

NocoDB has Stored Cross-site Scripting via Formula Cell

NocoDB Vulnerable to Stored Cross-site Scripting via Comments

NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field

NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells

NocoDB Vulnerable to User Enumeration via Password Reset Endpoint

NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells

NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality

NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS

NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vue

Improper Input Validation in nocodb

NocoDB vulnerable to Denial of Service

Cross-site Scripting in NocoDB

Insufficient Session Expiration in NocoDB

Improper Privilege Management in NocoDB

NocoDB information disclosure vulnerability

Browse more npm advisories

Start Securing