EUVD-2026-125232

NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values and column titles beginning with formula characters into CSV exports without neutralization. Low-privileged collaborators, or unauthenticated users submitting a public form, can...

CVE-2026-126289

NocoDB versions prior to 2026.06.1 are vulnerable to a CSV formula injection in the export.service.ts component. The root cause is the failure to neutralize record values and column titles that begin with formula characters during CSV exports. This allows low-privileged collaborators or unauthent...