CVE-2026-53931: NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

June 17, 2026 (updated July 20, 2026)

The spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv (for example https://example.com/robots.txt?.csv) satisfied the gate even though the underlying request was for robots.txt.

References

github.com/advisories/GHSA-hmcr-rmjq-47qr
github.com/nocodb/nocodb/security/advisories/GHSA-hmcr-rmjq-47qr
nvd.nist.gov/vuln/detail/CVE-2026-53931

Code Behaviors & Features

Detect and mitigate CVE-2026-53931 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →