PT-2026-50473 · Npm · Nocodb
Published
2026-06-17
·
Updated
2026-06-17
·
CVE-2026-53927
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Summary
The spreadsheet-fetch endpoint (
axiosRequestMake) accepted URLs whose path
contained a permitted extension anywhere in the string, and applied a hand-rolled
regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the
cloud-metadata endpoint to be reached with a crafted URL.Details
The extension matcher is now anchored to the end of the path or immediately before
the query string (
/.(xls|xlsx|xlsm|ods|ots)(?|$)/i and /.(csv)(?|$)/i), so
http://169.254.169.254/credentials/.xlsx no longer satisfies the format gate. The
hand-rolled IP blocklist is removed in favour of useAgent(url) from
request-filtering-agent, which blocks private and loopback ranges at the socket
layer.Impact
Authenticated users with editor permission could read cloud metadata and other
internal HTTP endpoints reachable from the NocoDB process. On affected installs the
spreadsheet import path was a credential-exfiltration primitive on cloud hosts.
Credit
This issue was reported by Devel Group Security Research Team through @TREXNEGRO.
It was independently reported by @l3tchupkt.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb