Medium, CVSS 4.3npmAmendedPublished
NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
CVE-2026-79914 · GHSA-wrr5-j383-f7h2
- Affected
- npm @nocobase/plugin-action-custom-request >= 2.1.0-alpha.8, < 2.1.15; >= 2.2.0-alpha.1, < 2.2.0-alpha.4
- Fixed in
- 2.2.0-alpha.42.1.15· Vendor fix available
- Issue
- A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the `@nocobase/plugin-action-custom-request` plugin. A low-privileged authenticated user can call the `customRequests:send` endpoint and override the stored request URL at runtime using `options.url`. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. * Product: NocoBase * Version: v2.1.10 * Component: `@nocobase/plugin-action-custom-request` * Severity: Moderate * Required privilege: authenticated low-privileged user / member Testing was performed only in a local Docker lab environment at `http://127.0.0.1:13000`. No public NocoBase instance was tested. Lab environment: * Docker image: `nocobase/nocobase:latest-full` * Commit: `23e2bd35625439594e4757bac31d57c9e8e695b9` * Database: PostgreSQL 16 * Containers: `nocobase-lab`, `nocobase-postgres` * Docker network: `172.19.0.0/16` * Important environment variable: `SERVER_REQUEST_WHITELIST` was…
Recommended action: Upgrade to 2.2.0-alpha.4 (pre-release) or 2.1.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.