PT-2026-50473 · Npm · Nocodb
Publicado
2026-06-17
·
Atualizado
2026-06-17
·
CVE-2026-53927
CVSS v4.0
5.1
Média
| Vetor | AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Summary
The spreadsheet-fetch endpoint (
axiosRequestMake) accepted URLs whose path
contained a permitted extension anywhere in the string, and applied a hand-rolled
regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the
cloud-metadata endpoint to be reached with a crafted URL.Details
The extension matcher is now anchored to the end of the path or immediately before
the query string (
/.(xls|xlsx|xlsm|ods|ots)(?|$)/i and /.(csv)(?|$)/i), so
http://169.254.169.254/credentials/.xlsx no longer satisfies the format gate. The
hand-rolled IP blocklist is removed in favour of useAgent(url) from
request-filtering-agent, which blocks private and loopback ranges at the socket
layer.Impact
Authenticated users with editor permission could read cloud metadata and other
internal HTTP endpoints reachable from the NocoDB process. On affected installs the
spreadsheet import path was a credential-exfiltration primitive on cloud hosts.
Credit
This issue was reported by Devel Group Security Research Team through @TREXNEGRO.
It was independently reported by @l3tchupkt.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Nocodb