CVE-2026-126289 · Package
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.06.1 writes record values and column titles that begin with formula characters into CSV exports without neutralizing them. When a user opens the export in a spreadsheet application, planted formulas can run, potentially leaking cell contents or invoking external commands.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host or run NocoDB and let collaborators or public forms enter data that is later exported to CSV and opened in a spreadsheet. Exposure comes from the export path, so instances without shared editors or public forms carry less risk. Deployments already on 2026.06.1 or later are not affected.
Not affected if default-config, no-public-forms
Who cares nocodb, self-hosted, spreadsheets
2026.06.1 are affected.2026.06.1 or later.NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.