SQL Injection Vulnerability in nocodb
Summary
CVE-2023-43794: nocodb SQL Injection vulnerability. Affects nocodb versions < 0.111.0. Fixed in 0.111.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nocodb is an open-source tool that allows users to create and manage databases with a user-friendly interface. It provides a web-based GUI for managing database tables, queries, and records. However, a SQL injection vulnerability has been discovered in nocodb, which can be exploited by an authenticated attacker with creator access to query the underlying database.
Vulnerability Detail
The SQL injection vulnerability in nocodb allows an attacker to inject arbitrary SQL queries through a specific parameter and endpoint. By crafting a specially designed payload, the attacker can execute SQL queries on the database and potentially retrieve sensitive information. This is a blind SQL injection, meaning the attacker may need to use time-based payloads to infer the query result based on the response time. The vulnerable code is located in the SqliteClient.ts file, specifically in the triggerList method. The impact of this vulnerability is information disclosure.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.111.0
This is the first release that contains the fix.
npm install nocodb@0.111.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected endpoint to trusted users only. This can be done by implementing proper access controls and authentication mechanisms. However, applying the patch and following secure coding practices is the recommended solution.
Conclusion
The SQL injection vulnerability in nocodb can lead to information disclosure, allowing an attacker to query the underlying database. It is crucial to upgrade to the latest version of nocodb and follow secure coding practices to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nocodb →
FAQ
nocodb is an open-source tool that provides a web-based GUI for managing databases.
A SQL injection vulnerability allows an attacker to manipulate SQL queries to execute arbitrary commands on a database.
This vulnerability was discovered and reported by a member of the GHSL team, Sylwia Budzynska.
The impact of this vulnerability is information disclosure, where an attacker can potentially access sensitive data from the database.
To fix this vulnerability, it is recommended to upgrade to version 0.111.0 or later of nocodb and implement proper input validation to prevent SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
