CVE-2026-126289
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can plant formulas that execute when a user opens the export in a spreadsheet application, potentially exfiltrating cell contents or invoking external commands.