PT-2026-47082 · Npm · Nocodb
Published
2026-06-05
·
Updated
2026-06-05
·
CVE-2026-47384
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Summary
An authenticated user with column-create permission can inject SQL into the bulk groupBy
endpoint by setting a column's title to a SQL fragment.
Details
The bulk groupBy path in
group-by.ts builds three database-specific knex.raw()
aggregations that interpolate the request's column name directly into the SQL string.
Column lookup in data-table.service.ts matches on both the sanitized column name
field and the free-text title, so a title containing a SQL fragment bypasses the
public endpoint's existing column allowlist and reaches the query builder unescaped.Impact
SQL injection against the connected database with read access to any expression an
attacker can place in a column title. Exploitation requires an authenticated session
with permission to create or rename columns.
Credit
This issue was reported by @geo-chen.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb