Summary The password reset flow did not revoke existing refresh tokens, allowing an attacker with a previously stolen refresh token to continue minting valid JWTs after the victim resets their password.
Details passwordReset() in users.service.ts updated tokenversion (invalidating JWTs) but did not call UserRefreshToken.deleteAllUserToken(). The refreshToken() method only checked token existence, not tokenversion. Both passwordChange() and signOut() correctly deleted all refresh tokens.
Impact An attacker who previously obtained a refresh token retains access after password reset until the token expires.
Credit This issue was reported by @bugbunny-research (bugbunny.ai).
Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute.
Details The replaceUrlsWithLink() function in urlUtils.ts converts URI::(url) patterns to <a> tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like CONCAT("URI::(https://example.com)", "<img src=x onerror=...>") to inject arbitrary scripts rendered for all viewers.
Impact Credential theft via script execution in the context of users viewing the table.
Credit This issue was reported by @Akokonunes.
Summary
A blind Server-Side Request Forgery (SSRF) vulnerability exists in the uploadViaURL functionality due to an unprotected HEAD request. While the subsequent file retrieval logic correctly enforces SSRF protections, the initial metadata request executes without validation.
This allows limited outbound requests to arbitrary URLs before SSRF controls are applied.
---
Vulnerability Details
The uploadViaURL() function issues an axios.head() request to retrieve metadata (content type, content length, and final URL after redirects). This request is performed without SSRF filtering.
Although the actual file download is protected by request filtering, the initial HEAD request occurs prior to these checks and can be triggered with an attacker-controlled URL.
Vulnerable Code
ts if (!url.startsWith('data:')) { response = await axios.head(url, { maxRedirects: 5 }); mimeType = response.headers['content-type']?.split(';')[0]; size = response.headers['content-length']; finalUrl = response.request.res.responseUrl; }
---
Impact
The impact of this issue is limited due to the following constraints:
Only HEAD requests are affected (no response body is returned) No direct exfiltration of response data occurs The subsequent file-fetching logic enforces SSRF protections
However, the vulnerability may still allow:
Blind SSRF via outbound HEAD requests Limited internal service probing (reachability and response behavior) Interaction with sensitive internal endpoints that respond to HEAD requests
This issue does not provide arbitrary data access or full internal network compromise on its own.
---
Severity
Moderate
The vulnerability is limited in scope and impact:
Only HEAD requests are affected No response body or sensitive data is directly returned The actual file download logic enforces SSRF protections
While the issue permits blind outbound requests to attacker-controlled URLs, it does not enable direct data exfiltration or full internal network compromise on its own.
---
Proof of Concept
bash curl -X POST 'http://localhost:8080/api/v2/storage/upload-by-url' \ -H 'Content-Type: application/json' \ -H 'xc-auth: <token>' \ -d '[{ "url": "http://169.254.169.254/latest/meta-data/", "fileName": "test.txt" }]'
This request causes the server to issue an unfiltered HEAD request before SSRF protections are applied.
---
Acknowledgements
This issue was first identified and responsibly disclosed by Faizan Raza of Kolega.dev as part of a security assessment using Kolega.dev Deep Code Scan, including validation and fix recommendations.
NocoDB also acknowledges Neel B for independently reporting the same issue prior to publication.
NocoDB thanks Kolega.dev for their contribution to improving the security posture of the project.
Summary
An authenticated user with org-level-creator permissions can exploit prototype pollution in the /api/v2/meta/connection/test endpoint, causing all database write operations to fail application-wide until server restart.
While the pollution technically bypasses SUPERADMIN authorization checks, no practical privileged actions can be performed because database operations fail immediately after pollution.
Details
The deepMerge() function in packages/nocodb/src/utils/dataUtils.ts does not sanitize the following keys: (proto, constructor, prototype):
typescript export const deepMerge = (target: any, ...sources: any[]) => { // ... Object.keys(source).forEach((key) => { if (isMergeableObject(source[key])) { if (!target[key]) target[key] = Array.isArray(source[key]) ? [] : {}; deepMerge(target[key], source[key]); // Recursively merges proto } else { target[key] = source[key]; } }); // ... };
The testConnection endpoint (packages/nocodb/src/controllers/utils.controller.ts) passes user-controlled input directly to deepMerge():
typescript config = await integration.getConfig(); deepMerge(config, body);
When an attacker sends {"proto": {"super": true}}, the super property is written to Object.prototype, affecting all plain objects in the Node.js process.
Impact
Pollutes Object.prototype globally, breaking all subsequent database write operations for all users until process restart.