CVE-2026-126289: NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.
Event History
Frequently Asked Questions
Who can introduce malicious formulas into exported data?
Low-privileged collaborators can plant formula-prefixed record values or column titles. Unauthenticated users can also do so when submitting data through a public form.
What user action is required for exploitation?
A user must open an affected CSV export in a spreadsheet application. The injected formula may then execute, potentially exfiltrating cell contents or invoking external commands.
Are public forms a relevant exposure path?
Yes. Any public form that accepts values later included in CSV exports can allow unauthenticated users to plant formula payloads.
Which versions are affected?
NocoDB versions before 2026.06.1 are affected.