{"id":"CVE-2026-53930","title":"NocoDB: Server-Side Request Forgery via Base Migration URL","summary":"NocoDB: Server-Side Request Forgery via Base Migration URL","severity":"medium","cwe":["CWE-918"],"vendor":"nocodb","product":"nocodb","ecosystem":"npm","affected":["nocodb <= 0.301.3"],"published":"2026-06-17","updated":"2026-06-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-h6vv-pcq8-7xm4","references":[{"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-h6vv-pcq8-7xm4"},{"url":"https://github.com/advisories/GHSA-h6vv-pcq8-7xm4"}],"tags":["ghsa","npm"],"epss":0.00388,"epssPercentile":0.30073,"ingestedAt":"2026-06-29T14:31:47.432Z","slug":"CVE-2026-53930","body":"## Overview\n\n### Summary\nThe base-migration endpoint accepted a caller-supplied URL that the migration worker\ndereferenced without enforcing protocol or destination, allowing scheme abuse\n(`file:`, `ftp:`, etc.) and probing of internal HTTP destinations.\n\n### Details\nThe `migrate` endpoint is restricted to the workspace owner role by ACL. The remaining\ngaps were (a) protocol validation — the controller now parses `body.migrationUrl` as a\n`URL` and rejects anything whose protocol is not `http:` or `https:` — and (b) private\ndestination filtering — the worker already runs through `useAgent(targetUrl)` from\n`request-filtering-agent`, which blocks RFC 1918, loopback, and link-local at the\nsocket layer.\n\n### Impact\nWith the workspace owner role, a malformed URL could be used to coerce the migration\nworker into reading local files or talking to non-HTTP services; combined with the\nHTTP-only filter, owner-supplied targets could not reach private ranges.\n\n### Credit\nThis issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO).\nIt was independently reported by [@Lihfdgjr](https://github.com/Lihfdgjr) and [@bugbunny-research (https://github.com/bugbunny-research).\n\n## Affected packages\n\n- `nocodb <= 0.301.3`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}