NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts
Summary
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plan...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| nocodbnocodb |
< 2026.06.1→ 2026.06.1 |
2026.06.1 |
Original description The description as published by the source.
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.
Source: CVE.org (CVE Program・cvelistV5) NVD