CVE-2026-47384
NocoDB: SQL Injection via Column Title in Bulk GroupBy
描述
### Summary An authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column's title to a SQL fragment. ### Details The bulk groupBy path in `group-by.ts` builds three database-specific `knex.raw()` aggregations that interpolate the request's `column_name` directly into the SQL string. Column lookup in `data-table.service.ts` matches on both the sanitized `column_name` field and the free-text `title`, so a title containing a SQL fragment bypasses the public endpoint's existing column allowlist and reaches the query builder unescaped. ### Impact SQL injection against the connected database with read access to any expression an attacker can place in a column title. Exploitation requires an authenticated session with permission to create or rename columns. ### Credit This issue was reported by [@geo-chen](https://github.com/geo-chen).
如何修補 CVE-2026-47384
要修補 CVE-2026-47384,請將受影響套件升級到下列已修補版本。
- —升級至 2026.05.1 或更新版本
CVE-2026-47384 正在被利用嗎?
目前沒有被利用訊號。CVE-2026-47384 既不在 CISA KEV 也沒有最新的 EPSS 分數。
受影響套件(1)
- from 0, < 2026.05.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |