---
id: CVE-2026-53927
title: 'NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL'
summary: 'NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL'
severity: medium
cwe:
  - CWE-918
vendor: nocodb
product: nocodb
ecosystem: npm
affected:
  - nocodb <= 0.301.3
published: '2026-06-17'
updated: '2026-06-17'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-gprh-27j3-g5h4'
references:
  - url: 'https://github.com/nocodb/nocodb/security/advisories/GHSA-gprh-27j3-g5h4'
  - url: 'https://github.com/advisories/GHSA-gprh-27j3-g5h4'
tags:
  - ghsa
  - npm
epss: 0.00388
epssPercentile: 0.30263
ingestedAt: '2026-06-29T14:31:47.436Z'
---

## Overview

### Summary
The spreadsheet-fetch endpoint (`axiosRequestMake`) accepted URLs whose path
contained a permitted extension anywhere in the string, and applied a hand-rolled
regex blocklist that omitted `127.0.0.0/8` and `169.254.0.0/16`, allowing the
cloud-metadata endpoint to be reached with a crafted URL.

### Details
The extension matcher is now anchored to the end of the path or immediately before
the query string (`/\.(xls|xlsx|xlsm|ods|ots)(\?|$)/i` and `/\.(csv)(\?|$)/i`), so
`http://169.254.169.254/credentials/.xlsx` no longer satisfies the format gate. The
hand-rolled IP blocklist is removed in favour of `useAgent(url)` from
`request-filtering-agent`, which blocks private and loopback ranges at the socket
layer.

### Impact
Authenticated users with editor permission could read cloud metadata and other
internal HTTP endpoints reachable from the NocoDB process. On affected installs the
spreadsheet import path was a credential-exfiltration primitive on cloud hosts.

### Credit
This issue was reported by Devel Group Security Research Team through [@TREXNEGRO](https://github.com/TREXNEGRO).
It was independently reported by [@l3tchupkt](https://github.com/l3tchupkt).

## Affected packages

- `nocodb <= 0.301.3`

## Remediation

Refer to the advisory for the patched release.