NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts
概要
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plan...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| nocodbnocodb |
2026.06.1 未満→ 2026.06.1 |
2026.06.1 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.
出典: CVE.org (CVE Program・cvelistV5) NVD