NocoDB EUVD-2026-38616

NocoDB is an open-source no-code database platform distributed as an npm package (pkg:npm/nocodb). The affected code paths are in group-by.ts, which constructs database-specific Knex ORM aggregation queries using knex.raw() - a low-level escape hatch that bypasses Knex's built-in parameterization when user-controlled strings are interpolated directly into the SQL template. The root bypass lives in data-table.service.ts: column resolution matches on both the sanitized column_name field and the free-text title field. Because the bulk groupBy endpoint maintains a column allowlist keyed on column_name, an attacker who sets a column's title to a SQL fragment causes the lookup to resolve the column via the unsanitized title path, delivering the fragment directly into the raw SQL string. This is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect, specifically a second-order injection variant where the malicious payload is stored in the column title before being consumed by the query builder.