### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. ### Details The bulk groupBy path in `group-by.ts` builds three database-specific `knex.raw()` aggregations that interpolate the request's `column_name` directly into the SQL string. Column lookup in `data-table.service.ts` matches on both the sanitized `column_name` field and the free-text `title`, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. ### Impact SQL injection against the connected database with read access to any expression an attacker can place in a column title. Exploitation requires an authenticated session with permission to create or rename columns. ### Credit This issue was reported by [@geo-chen](https://github.com/geo-chen).
Update nocodb to 2026.05.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanNocoDB: SQL Injection via Column Title in Bulk GroupBy affects nocodb (npm). Severity is medium. ### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. ### Details The bulk groupBy path in `group-by.ts` builds three database-specific `knex.raw()` aggregations that interpolate the request's `column_name` directly into the SQL string. Column lookup in `data-table.service.ts` matches on both the sanitized `column_name` field and the free-text `title`, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. ### Impact SQL injection against the connected database with read access to any expression an attacker can place in a column title. Exploitation requires an authenticated session with permission to create or rename columns. ### Credit This issue was reported by [@geo-chen](https://github.com/geo-chen).
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. ### Details The bulk groupBy path in `group-by.ts` builds three database-specific `knex.raw()` aggregations that interpolate the request's `column_name` directly into the SQL string. Column lookup in `data-table.service.ts` matches on both the sanitized `column_name` field and the free-text `title`, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. ### Impact SQL injection against the connected database with read access to any expression an attacker can place in a column title. Exploitation requires an authenticated session with permission to create or rename columns. ### Credit This issue was reported by [@geo-chen](https://github.com/geo-chen).
Update nocodb to 2026.05.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanNocoDB: SQL Injection via Column Title in Bulk GroupBy affects nocodb (npm). Severity is medium. ### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. ### Details The bulk groupBy path in `group-by.ts` builds three database-specific `knex.raw()` aggregations that interpolate the request's `column_name` directly into the SQL string. Column lookup in `data-table.service.ts` matches on both the sanitized `column_name` field and the free-text `title`, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. ### Impact SQL injection against the connected database with read access to any expression an attacker can place in a column title. Exploitation requires an authenticated session with permission to create or rename columns. ### Credit This issue was reported by [@geo-chen](https://github.com/geo-chen).
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
| Fixed version |
|---|
| nocodbnpm | <=2026.05.0 | 2026.05.1 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Fixed version |
|---|
| nocodbnpm | <=2026.05.0 | 2026.05.1 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard