CVE-2026-47383 Details
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths persisted the raw comment body with no server-side sanitisation; the expanded-form sidebar then rendered the stored body and fed its data-tooltip attribute to Tippy with allowHTML: true. Even when the editor stripped script tags at write time, attribute-level payloads re-entered the DOM as live HTML on hover. This vulnerability is fixed in 2026.05.1.
A stored cross-site scripting vulnerability has been identified in NocoDB versions prior to 2026.05.1. This issue allows authenticated commenters to inject HTML into row comments, which is then executed as a script when other users hover over the comment in the expanded form view. The vulnerability arises because the comment write paths do not sanitize the raw comment body on the server side. Instead, the expanded-form sidebar renders the stored body and passes its data-tooltip attribute to Tippy with allowHTML set to true. Although the editor removes script tags when comments are written, payloads targeting attributes can reintroduce live HTML into the DOM upon hover. This vulnerability could be exploited by any user viewing the affected row, as the injected script would run in the context of the NocoDB origin, using the victim's session and accessing the authentication JWT from localStorage. Exploitation requires authentication and comment permissions.
Users can update to NocoDB version 2026.05.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nocodb/nocodb/security/advisories/GHSA-jf3g-4gwg-4h66 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NocoDB | <= 2026.05.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |