{"id":"CVE-2026-53927","title":"NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL","summary":"NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL","severity":"medium","cwe":["CWE-918"],"vendor":"nocodb","product":"nocodb","ecosystem":"npm","affected":["nocodb <= 0.301.3"],"published":"2026-06-17","updated":"2026-06-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gprh-27j3-g5h4","references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-gprh-27j3-g5h4"},{"url":"https://github.com/advisories/GHSA-gprh-27j3-g5h4"}],"tags":["ghsa","npm"],"epss":0.00388,"epssPercentile":0.30263,"ingestedAt":"2026-06-29T14:31:47.436Z","slug":"CVE-2026-53927","body":"## Overview\n\n### Summary\nThe spreadsheet-fetch endpoint (`axiosRequestMake`) accepted URLs whose path\ncontained a permitted extension anywhere in the string, and applied a hand-rolled\nregex blocklist that omitted `127.0.0.0/8` and `169.254.0.0/16`, allowing the\ncloud-metadata endpoint to be reached with a crafted URL.\n\n### Details\nThe extension matcher is now anchored to the end of the path or immediately before\nthe query string (`/\\.(xls|xlsx|xlsm|ods|ots)(\\?|$)/i` and `/\\.(csv)(\\?|$)/i`), so\n`http://169.254.169.254/credentials/.xlsx` no longer satisfies the format gate. The\nhand-rolled IP blocklist is removed in favour of `useAgent(url)` from\n`request-filtering-agent`, which blocks private and loopback ranges at the socket\nlayer.\n\n### Impact\nAuthenticated users with editor permission could read cloud metadata and other\ninternal HTTP endpoints reachable from the NocoDB process. On affected installs the\nspreadsheet import path was a credential-exfiltration primitive on cloud hosts.\n\n### Credit\nThis issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO).\nIt was independently reported by [@l3tchupkt](https://github.com/l3tchupkt).\n\n## Affected packages\n\n- `nocodb <= 0.301.3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}