Pavanchow

An uncontrolled resource consumption issue exists where unauthenticated attackers can exhaust server resources. By possessing a shared view UUID, an attacker can send a large body of minimal filter objects via a POST request to shared-view bulk endpoints. This action triggers a full database query for every entry provided, which can lead to the NocoDB process crashing.

A flaw allows a remote attacker to write arbitrary OS-shortcut files, such as `.desktop`, `.url`, and `.webloc`, to the user's filesystem. This occurs because the file extension allowlist used to prevent unsafe downloads explicitly included these shortcut extensions to maintain the functionality of the `--write-link` option. Attackers can exploit this by crafting a malicious m3u8 file containing an `EXT-X-MEDIA:TYPE=SUBTITLES` tag with a malicious URI. If a user employs the `--write-subs` option, the software may write attacker-controlled content to a file with a shortcut extension. These files can contain shell commands or point to remote executables, enabling phishing attacks or arbitrary code execution if a user is deceived into opening them.