### Summary The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (`file:`, `ftp:`, etc.) and probing of internal HTTP destinations. ### Details The `migrate` endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses `body.migrationUrl` as a `URL` and rejects anything whose protocol is not `http:` or `https:` — and (b) private destination filtering — the worker already runs through `useAgent(targetUrl)` from `request-filtering-agent`, which blocks RFC 1918, loopback, and link-local at the socket layer. ### Impact With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges. ### Credit This issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO). It was independently reported by [@Lihfdgjr](https://github.com/Lihfdgjr) and [@bugbunny-research (https://github.com/bugbunny-research).
### Summary The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (`file:`, `ftp:`, etc.) and probing of internal HTTP destinations. ### Details The `migrate` endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses `body.migrationUrl` as a `URL` and rejects anything whose protocol is not `http:` or `https:` — and (b) private destination filtering — the worker already runs through `useAgent(targetUrl)` from `request-filtering-agent`, which blocks RFC 1918, loopback, and link-local at the socket layer. ### Impact With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges. ### Credit This issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO). It was independently reported by [@Lihfdgjr](https://github.com/Lihfdgjr) and [@bugbunny-research (https://github.com/bugbunny-research).
Monitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanNocoDB: Server-Side Request Forgery via Base Migration URL affects nocodb (npm). Severity is medium. ### Summary The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (`file:`, `ftp:`, etc.) and probing of internal HTTP destinations. ### Details The `migrate` endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses `body.migrationUrl` as a `URL` and rejects anything whose protocol is not `http:` or `https:` — and (b) private destination filtering — the worker already runs through `useAgent(targetUrl)` from `request-filtering-agent`, which blocks RFC 1918, loopback, and link-local at the socket layer. ### Impact With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges. ### Credit This issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO). It was independently reported by [@Lihfdgjr](https://github.com/Lihfdgjr) and [@bugbunny-research (https://github.com/bugbunny-research).
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| nocodbnpm | <=0.301.3 | Not reported |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardMonitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanNocoDB: Server-Side Request Forgery via Base Migration URL affects nocodb (npm). Severity is medium. ### Summary The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (`file:`, `ftp:`, etc.) and probing of internal HTTP destinations. ### Details The `migrate` endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses `body.migrationUrl` as a `URL` and rejects anything whose protocol is not `http:` or `https:` — and (b) private destination filtering — the worker already runs through `useAgent(targetUrl)` from `request-filtering-agent`, which blocks RFC 1918, loopback, and link-local at the socket layer. ### Impact With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges. ### Credit This issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO). It was independently reported by [@Lihfdgjr](https://github.com/Lihfdgjr) and [@bugbunny-research (https://github.com/bugbunny-research).
AI coding agents often install or upgrade packages automatically in npm. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| nocodbnpm | <=0.301.3 | Not reported |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard