GHSA-h6vv-pcq8-7xm4

Source

https://github.com/advisories/GHSA-h6vv-pcq8-7xm4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-h6vv-pcq8-7xm4/GHSA-h6vv-pcq8-7xm4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h6vv-pcq8-7xm4

Aliases

CVE-2026-53930

Published

2026-06-17T14:08:04Z

Modified

2026-06-17T14:15:07.736569401Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

NocoDB: Server-Side Request Forgery via Base Migration URL

Details

Summary

The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (file:, ftp:, etc.) and probing of internal HTTP destinations.

Details

The migrate endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses body.migrationUrl as a URL and rejects anything whose protocol is not http: or https: — and (b) private destination filtering — the worker already runs through useAgent(targetUrl) from request-filtering-agent, which blocks RFC 1918, loopback, and link-local at the socket layer.

Impact

With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges.

Credit

This issue was reported by Devel Group Security Research Team through @TREXNEGRO. It was independently reported by @Lihfdgjr and [@bugbunny-research (https://github.com/bugbunny-research).

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-918"
    ],
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2026-06-17T14:08:04Z"
}

References

Affected packages

npm / nocodb

Package

Name: nocodb; View open source insights on deps.dev
Purl: pkg:npm/nocodb

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.301.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-h6vv-pcq8-7xm4/GHSA-h6vv-pcq8-7xm4.json"