VulertSecurity VulertSecurity

Vulnerability Database · npm · nocodb · Version

nocodb 0.204.6

0.204.6 is affected by 44 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.301.3.

Critical 0 High 3 Medium 34 Low 7 Unrated 0

All nocodb versions & vulnerabilities → Source repository Search the database for this package →
Released 19 Mar 2024 Licence AGPL-3.0-or-later Also known from other sources 44 Newer releases 295 Database updated 23/Oct/2026

Release and licence data published by the npm registry. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

nocodb 0.204.6 vulnerabilities

44 vulnerabilities cover nocodb 0.204.6. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-24769: NocoDB Stored XSS Vulnerability via SVG Upload 8.5 high 0.301.0 28 Jan 2026
CVE-2026-47387: NocoDB Stored Cross-Site Scripting via Form View Redirect URL 8.4 high 2026.05.1 05 Jun 2026
CVE-2026-47383: NocoDB Stored Cross-Site Scripting Vulnerability via Row Comments 7.4 high 2026.05.1 05 Jun 2026
CVE-2026-53931: NocoDB Server-Side Request Forgery via Spreadsheet Import Endpoint 6.9 medium No fix published 17 Jun 2026
CVE-2026-47381: NocoDB Cross-Workspace Integration Vulnerability in Connection Test 6.9 medium 2026.05.1 05 Jun 2026
CVE-2026-47379: NocoDB Plaintext Password Comparison Vulnerability 6.9 medium 2026.05.1 05 Jun 2026
CVE-2026-47378: NocoDB Hidden Column Exposure in Public Shared View Endpoints 6.9 medium 2026.04.1 05 Jun 2026
CVE-2026-47279: NocoDB LTAR Column Exposure in Public Shared-View Relation Endpoints 6.9 medium 2026.05.1 05 Jun 2026
CVE-2026-46551: NocoDB Denial of Service via Missing File Size Enforcement in Upload-by-URL 6.5 medium No fix published 21 May 2026
CVE-2026-53928: NocoDB Refresh Tokens Persist Through Password Recovery Vulnerability 6.3 medium No fix published 17 Jun 2026
OAuth Token Persistence Vulnerability in NocoDB: Unauthorized Access Risk 6.3 medium 2026.05.1 05 Jun 2026
CVE-2026-47386: NocoDB OAuth Authorization Code Race Condition Vulnerability 6.3 medium 2026.05.1 05 Jun 2026
CVE-2026-28399: NocoDB SQL Injection Vulnerability via DATEADD Formula 6.2 medium 0.301.3 03 Mar 2026
CVE-2026-46547: NocoDB Reflected XSS Vulnerability via Page Leaving Redirect URL 6.1 medium No fix published 21 May 2026
CVE-2025-27506: NocoDB Reflected Cross-Site Scripting Vulnerability on Password Reset Page 6.1 medium 0.258.0 06 Mar 2025
CVE-2026-47375: NocoDB SQL Injection Vulnerability in ARRAYSORT Function 6.0 medium 2026.04.1 05 Jun 2026
CVE-2026-46552: NocoDB Vulnerability Allows Arbitrary User Invites via Shared Links 5.8 medium No fix published 21 May 2026
CVE-2026-24768: NocoDB Unvalidated Redirect Vulnerability in Login Flow 5.6 medium 0.301.0 28 Jan 2026
CVE-2026-46550: NocoDB Refresh Token Cookie Vulnerability Exposes Users to CSRF and Interception Risks 5.4 medium No fix published 21 May 2026
CVE-2026-47385: NocoDB Path Traversal Vulnerability Allows Unauthorized File Access 5.3 medium 2026.05.1 05 Jun 2026
CVE-2026-47384: NocoDB SQL Injection via Column Title in Bulk GroupBy 5.3 medium 2026.05.1 05 Jun 2026
CVE-2026-47382: NocoDB Server-Side Request Forgery via Database Connection Host 5.3 medium 2026.05.1 05 Jun 2026
CVE-2026-28401: NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells 5.3 medium 0.301.3 03 Mar 2026
CVE-2026-28397: NocoDB Stored Cross-site Scripting Vulnerability via Comments 5.3 medium 0.301.3 03 Mar 2026
CVE-2026-28398: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells 5.3 medium 0.301.3 03 Mar 2026
CVE-2026-28359: NocoDB Stored Cross-site Scripting Vulnerability in Rich Text Field 5.3 medium 0.301.3 02 Mar 2026
CVE-2026-28357: NocoDB Stored Cross-site Scripting via Formula Cell 5.3 medium 0.301.3 02 Mar 2026
CVE-2026-53930: NocoDB Server-Side Request Forgery via Base Migration URL 5.1 medium No fix published 17 Jun 2026
CVE-2026-53929: NocoDB Stored Cross-Site Scripting via Secure Attachment 5.1 medium No fix published 17 Jun 2026
CVE-2026-53927: NocoDB Server-Side Request Forgery via Spreadsheet Fetch URL 5.1 medium No fix published 17 Jun 2026
CVE-2026-47377: NocoDB Open Redirect via Hash Fragment in hashRedirect Plugin 5.1 medium 2026.04.1 05 Jun 2026
CVE-2026-47376: NocoDB Reflected Cross-Site Scripting via Password Reset Token 5.1 medium 2026.04.1 05 Jun 2026
CVE-2026-28361: NocoDB MCP Token Operations Lacks Ownership Validation 4.9 medium 0.301.3 02 Mar 2026
CVE-2026-28396: NocoDB Refresh Tokens Not Revoked on Password Reset 4.9 medium 0.301.3 02 Mar 2026
CVE-2026-24766: NocoDB Prototype Pollution Vulnerability Leading to Denial of Service 4.9 medium 0.301.0 28 Jan 2026
CVE-2026-24767: NocoDB Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality 4.9 medium 0.301.0 28 Jan 2026
CVE-2026-46548: NocoDB SSRF Protection Bypass in Notification Webhook Plugins 4.3 medium No fix published 21 May 2026
CVE-2026-28360: NocoDB Plaintext Storage of Shared View Passwords Vulnerability 2.7 low 0.301.3 02 Mar 2026
CVE-2026-28358: NocoDB User Enumeration via Password Reset Endpoint 2.7 low 0.301.3 02 Mar 2026
CVE-2026-47388: NocoDB Arbitrary File Read Vulnerability Due to Missing Ownership Check 2.3 low 2026.05.1 05 Jun 2026
CVE-2026-46554: NocoDB API Token Deletion Leads to Stale Authentication 2.3 low No fix published 21 May 2026
CVE-2026-46553: NocoDB Attachment Size Limit Bypass via Upload-by-URL 2.1 low No fix published 21 May 2026
CVE-2026-46549: NocoDB OAuth Token Scope Bypass Vulnerability 2.0 low No fix published 21 May 2026
CVE-2026-47380: NocoDB User Enumeration via Sign-In Timing Vulnerability N/A low 2026.04.1 05 Jun 2026

Looking for another version, or everything Vulert holds for nocodb?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About nocodb 0.204.6

Is nocodb 0.204.6 vulnerable?

Yes. 44 vulnerabilities in the Vulert database cover nocodb 0.204.6: 0 critical, 3 high, 34 medium and 7 low. The upgrade Vulert recommends is 0.301.3, and each entry above names the fixed version to move to.

Which version of nocodb should I use instead of 0.204.6?

0.301.3 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.204.6 the latest release of nocodb?

No. 0.204.6 was published 19 Mar 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor nocodb for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the nocodb version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.