CSV Formula Injection Vulnerability in NocoDB by NocoDB

CVE-2026-126289

What is CVE-2026-126289?

The NocoDB application prior to version 2026.06.1 is susceptible to a CSV formula injection vulnerability. This issue stems from the export.service.ts module, which inadequately neutralizes record values and column headers starting with formula characters in CSV exports. As a result, low-privileged collaborators or unauthenticated users can embed malicious formulas in public forms. When an unsuspecting user opens the exported CSV in a spreadsheet application, these formulas may execute, potentially leading to unauthorized access to cell contents or the execution of external commands.

References