NocoDB Prototype Pollution Vulnerability in Connection Test Endpoint Leading to Denial-of-Service

A prototype pollution vulnerability has been identified in NocoDB versions prior to 0.301.0. This issue allows an authenticated user with org-level-creator permissions to exploit the '/api/v2/meta/connection/test' endpoint. The exploitation causes all database write operations to fail application-wide, creating a denial-of-service condition that persists until the server is restarted. Although the pollution bypasses SUPER_ADMIN authorization checks, it does not enable any practical privileged actions, as database operations fail immediately after the pollution occurs.

Impact

Exploitation of this vulnerability pollutes Object.prototype globally, disrupting all database write operations for every user until the Node.js process is restarted.

Remediation

Users can upgrade to NocoDB version 0.301.0 or later to address this vulnerability.