SQL injection in NocoDB - #VU162872
Published: November 9, 2026
Vulnerability identifier: #VU162872
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with base schema-edit rights to modify or drop columns in connected MySQL or MariaDB databases.
The vulnerability exists due to inadequate backslash escaping in NocoDB select-field option titles embedded in column definitions under default database SQL modes. An authenticated attacker with base schema-edit rights can submit crafted option titles to inject arbitrary clauses into generated ALTER TABLE statements on sources the base can write to.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.1