CVE-2026-53927
CVE-2026-53927 · NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path contained a permitted extension anywhere in the string, and applied a hand-rolled regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the cloud-metadata endpoint to be reached with a crafted URL This vulnerability is fixed in 2026.05.1.
CVSS 5.1 · Media · EPSS 0,4%
- Publicación
- Actualización
Pila tecnológica: node