CVE-2022-22121

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-22121
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22121.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-22121
Published
2022-01-10T16:15:10.243Z
Modified
2026-03-14T11:27:23.094113Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.

References

Affected packages

Git / github.com/nocodb/nocodb

Affected ranges

Type
GIT
Repo
https://github.com/nocodb/nocodb
Events
Introduced
ff95d8fff8d14d469f107b8be729b774f17e1bf0
Last affected
aa3348ae164de24e2b93b9f17e8b753ac1b1ff20
Fixed
079e3abe
Database specific 
{
    "versions": [
        {
            "introduced": "0.81.0"
        },
        {
            "last_affected": "0.83.8"
        }
    ]
}

Affected versions

0.*
0.81.0
0.81.1
0.82.0
0.83.0
0.83.1
0.83.2
0.83.3
0.83.4
0.83.5
0.83.6
0.83.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-22121.json"