CVE-2026-126289
Received Received - Intake

CSV Formula Injection in NocoDB Prior to 2026.06.1

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126289
EUVD
EUVD-2026-125232

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocodb nocodb to 2026.06.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoDB before version 2026.06.1 has a CSV formula injection vulnerability in the export.service.ts file. This allows low-privileged users or unauthenticated individuals submitting public forms to inject formulas into CSV exports by starting record values or column titles with formula characters like equals (=) or plus (+). When opened in a spreadsheet application, these formulas execute, potentially exfiltrating data or running external commands.

Detection Guidance

Check NocoDB version with command: npm list nocodb or grep version in package.json. Inspect export.service.ts for improper neutralization of formula characters in CSV exports.

Impact Analysis

If you use NocoDB versions before 2026.06.1 and export data to CSV, an attacker could inject malicious formulas into the file. When you open the CSV in a spreadsheet, the formula may execute, leading to data theft, unauthorized access to local files, or execution of external commands depending on your spreadsheet application's settings.

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected NocoDB versions may face compliance breaches if sensitive data is exposed through formula injection in CSV exports.

Mitigation Strategies

Upgrade NocoDB to version 2026.06.1 or later. Review and sanitize CSV export functions to neutralize formula characters in column titles and cell values before export.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...