SQL Injection

nocodb is vulnerable to SQL Injection. The vulnerability is due improper sanitization of the tablename parameter within VitessClient.ts, which allows an authenticated attacker with the create access permission to execute arbitrary SQL by escaping the query with a ' character within the tablename...