PT-2026-5218 · Nocodb · Nocodb

Cp-57 · Published 2026-01-28 · Updated 2026-01-29 · CVE-2026-24766

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.0

Description An authenticated user with org-level-creator permissions can exploit prototype pollution in the /api/v2/meta/connection/test endpoint. This causes all database write operations to fail application-wide until server restart. The issue stems from the deepMerge() function in packages/nocodb/src/utils/dataUtils.ts, which does not sanitize keys like proto, constructor, and prototype. The testConnection endpoint in packages/nocodb/src/controllers/utils.controller.ts passes user-controlled input directly to deepMerge(). Sending a payload like {" proto ": {"super": true}} writes the super property to Object.prototype, impacting all plain objects in the Node.js process. The vulnerable function is deepMerge(). The vulnerable parameter is body.

Recommendations Versions prior to 0.301.0 should be updated to version 0.301.0 or later.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-24766

GHSA-95FF-46G6-6GW9

Affected Products

Nocodb

References · 10

• 🔥 https://github.com/nocodb/nocodb/security/advisories/GHSA-95ff-46g6-6gw9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24766.json · Exploit
• https://osv.dev/vulnerability/GHSA-95ff-46g6-6gw9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24766 · Security Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.0 · Note
• https://twitter.com/VulmonFeeds/status/2016668393621831973 · Twitter Post
• https://twitter.com/_cvereports/status/2016635116043288581 · Twitter Post
• https://t.me/CVEtracker/43194 · Telegram Post