teable
release.2026-11-13T02-21-01Z.3890✨ AI Spreadsheet for Business
- Maintenance
- Active18 commits in 3 months · bus factor 2
- License
- OtherUnknown
- Security
- 30 advisories7 high, 21 medium, 2 low
- Supported versions
- No scheduleendoflife.date does not track this project
22k stars · 1.4k forks · 149 open issues · last release 2 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 7 high, 21 medium, 2 low. Check the patched version against the one you run.
- mediumGHSA-3w7j-7hpq-74cjNov 3, 2026Cross-base read and write via unscoped `tableId` on `/api/integrity/base/:baseId/link-check` and `link-fix`
- Affected
- < release.2026-11-03T05-42-34Z.3718
- Patched in
- release.2026-11-03T05-42-34Z.3718
- highGHSA-p4qm-93qw-7qhvNov 3, 2026authenticated base import can read arbitrary server files through export thumbnails
- Affected
- < release.2026-11-03T05-42-34Z.3718
- Patched in
- release.2026-11-03T05-42-34Z.3718
- highGHSA-c58g-j3wm-3hqgOct 30, 2026ShareDB presence channels missing authorization — anonymous cross-tenant information disclosure + spoofing
- Affected
- < release.2026-10-29T09-09-28Z.3650
- Patched in
- release.2026-10-29T09-09-28Z.3650
- mediumGHSA-3452-hq3g-22gcOct 27, 2026Cross-base link write & record oracle via /record/form-submit bypasses assertForeignTablesReadable (incomplete fix of GHSA-vqm3-2pqv-cx89)
- Affected
- < release.2026-10-27T02-17-21Z.3593
- Patched in
- release.2026-10-27T02-17-21Z.3593
- highGHSA-5gph-69xh-rccqOct 27, 2026SQL injection via unescaped currency symbol number-formatting option (record-query CTEs), exploitable by a low-privileged base editor
- Affected
- < release.2026-10-27T02-17-21Z.3593
- Patched in
- release.2026-10-27T02-17-21Z.3593
- mediumGHSA-c3m3-rchr-3vr9Oct 27, 2026Public-share uploads bypass the configured size limit and leave rejected files on disk
- Affected
- < release.2026-10-27T02-17-21Z.3593
- Patched in
- release.2026-10-27T02-17-21Z.3593
- mediumGHSA-9pmg-5mmm-9j2cOct 27, 2026Cross-Site Request Forgery (Login CSRF) via mobile auth code exchange
- Affected
- < release.2026-10-27T02-17-21Z.3593
- Patched in
- release.2026-10-27T02-17-21Z.3593
- mediumGHSA-874f-8fvw-pwx2Oct 21, 2026Teable: cross-base link write skips the foreign-table read check when `typecast=false` (follow-up to GHSA-vqm3-2pqv-cx89)
- Affected
- < release.2026-10-21T02-11-07Z.3507
- Patched in
- release.2026-10-21T02-11-07Z.3507
- highGHSA-gfhp-53cj-g8c8Oct 21, 2026SQL injection in base-query select aliasing via attacker-controlled `select[].alias` (dashboard / plugin-panel chart query)
- Affected
- < release.2026-10-21T02-11-07Z.3507
- Patched in
- release.2026-10-21T02-11-07Z.3507
- highGHSA-4rch-rfjf-6m86Oct 15, 2026Legacy shared calendar and copy expose records despite includeRecords=false
- Affected
- < release.2026-10-14T12-10-48Z.3400
- Patched in
- release.2026-10-14T12-10-48Z.3400
- lowGHSA-5qj3-rq3x-q739Oct 13, 2026Cross-base folder rename through incorrect object authorization in PATCH /api/base/:baseId/node/folder/:folderId
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- lowGHSA-4f46-25vh-w54qOct 13, 2026An access token scoped only to record|update can read a record's full change history and editor identities
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-p8x2-vpf5-3f6xOct 13, 2026Cross-base Broken Access Control via Link/Lookup fields — a base-only collaborator can read data from a sibling base they have no membership in
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-75j7-974w-84gfOct 13, 2026Stored XSS in MarkdownPreview (rehype-raw without sanitization) via plugin detailDesc and template markdownDescription
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-jvm6-86c5-f8j8Oct 13, 2026SSRF via AI provider baseUrl — bypasses safeFetch, reachable by space|updat
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-46gp-hqm6-q5f8Oct 13, 2026Unvalidated `x-automation-internal` header lets unauthenticated callers spoof a real system identity on public share routes, and every audit event is silently dropped
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-rp9v-chj8-gchhOct 13, 2026`restore-field/:trashId/stream` skips the permission check its record-restore sibling performs, letting any authenticated caller inject deleted fields/records into a victim table
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-8wrp-pwv2-48rvOct 13, 2026Missing authorization on mail transport-test endpoint enables authenticated SSRF (internal port scan) by any user incl. viewers
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-x7rc-cwmr-j9rmOct 13, 2026Comment @mentions notify any user ID with no collaborator check, leaking record content to users with zero base access
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-6v6w-wvv5-c96pOct 13, 2026Legacy /api/chart/completions AI proxy has no authorization check, letting any account use the operator's LLM credential unrestricted
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-v745-5v6v-f3r8Oct 13, 2026OAuth authorization code exchange is not atomic, allowing a single-use code to be redeemed twice under a race
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-v4g3-8wc4-7m74Oct 13, 2026Undo/redo replay bypasses current record create/delete permissions for a since-downgraded collaborator
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-4x7c-hmrf-xwg6Oct 13, 2026Public view-share link-records endpoint ignores the view's row filter, leaking linked-record identities for rows the filter excludes
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-vqm3-2pqv-cx89Oct 13, 2026Cross-base record disclosure: /table/{tableId}/selection/temporaryPaste reads a linked foreign table with no permission check, letting a base-scoped user read another base's records they cannot access directly
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-whgj-94w8-grpqOct 13, 2026public shared-view record snapshot socket route returns hidden columns (skips the field projection its share siblings enforce)
- Affected
- < release.2026-09-02T03-16-51Z.2899
- Patched in
- release.2026-09-02T03-16-51Z.2899
- mediumGHSA-3rmq-5wwc-x8w2Oct 13, 2026Stored XSS in notifications via unsanitized display name
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- mediumGHSA-c57x-9c9p-96jmOct 13, 2026[Low] OAuth access tokens silently gain base|read_all beyond consented scope
- Affected
- < release.2026-07-21T11-27-40Z.2320
- Patched in
- release.2026-07-21T11-27-40Z.2320
- mediumGHSA-m5gm-jc2c-547pOct 13, 2026[Moderate] Authenticated SSRF via GET /api/import/analyze (missing @Permissions + no SSRF guard)
- Affected
- < release.2026-07-30T06-45-38Z.2429
- Patched in
- release.2026-07-30T06-45-38Z.2429
- highGHSA-m2c3-cgc4-p3fcOct 13, 2026Space integrations are not scoped to the space; the comment attachment presign route signs any path; the LLM test bypasses the project's own SSRF guard
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331
- highGHSA-j6f8-jh26-mmq4Oct 13, 2026OAuth consent for email-only scope silently approves later base-read scopes
- Affected
- < release.2026-10-12T12-45-53Z.3331
- Patched in
- release.2026-10-12T12-45-53Z.3331