If you believe you have discovered a security vulnerability in NocoDB, please report it to us at security@nocodb.com.
We will evaluate your report. If the issue is confirmed, we will work on a patch as soon as possible.
Security: nocodb/nocodb
Security
SECURITY.md
-
Stored Cross-Site Scripting via Form View Redirect URLGHSA-hj85-ph9q-78jg published
Jun 4, 2026 by mertmitHigh -
OAuth Authorization Code Race ConditionGHSA-8m7c-hf24-5g47 published
Jun 4, 2026 by mertmitLow -
SQL Injection via Column Title in Bulk GroupByGHSA-p8wx-5f39-w3x4 published
Jun 4, 2026 by mertmitModerate -
Path Traversal via SQLite Source FilenameGHSA-wvqj-9wv4-7ff5 published
Jun 4, 2026 by mertmitModerate -
Stored Cross-Site Scripting via Row CommentsGHSA-jf3g-4gwg-4h66 published
Jun 4, 2026 by mertmitHigh -
Attachment Size Limit Bypass via Upload-by-URLGHSA-8rwr-f68v-cvw6 published
May 19, 2026 by mertmitLow -
Stale Auth Cache After API Token DeletionGHSA-f76x-f9vj-92jv published
May 19, 2026 by mertmitModerate -
OAuth Tokens Persist Through Security EventsGHSA-g72g-r7m4-9x4g published
Jun 4, 2026 by mertmitLow -
Refresh Tokens Persist Through Password RecoveryGHSA-r989-7g3j-wjhw published
Jun 13, 2026 by mertmitModerate -
Stored Cross-Site Scripting via Secure AttachmentGHSA-6mhr-74x2-98v9 published
Jun 13, 2026 by mertmitLow
Learn more about advisories related to nocodb/nocodb in the GitHub Advisory Database