# CVE-2026-47375: NocoDB SQL injection in ARRAYSORT formula for PostgreSQL

Source: https://junglewise.ai/threats/cve-2026-47375-nocodb-sql-injection-in-arraysort-formula-for-postgresql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-47375 · Severity: medium · CVSS 6 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allows users with administrative permissions to inject malicious database commands when creating specific types of formula columns on systems using PostgreSQL. This could allow an attacker to cause significant performance slowdowns, disrupt operations, or potentially access unauthorized data within the database.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-47375 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47375 being exploited in the wild.

**How severe is CVE-2026-47375?** Medium severity, with a CVSS score of 6, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) < 2026.04.1, ECOSYSTEM:introduced=0,fixed=2026.04.1.

**Is there a fix for CVE-2026-47375?** Yes. nocodb (npm): upgrade to 2026.04.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47375 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47375?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 2026.04.1 or later

  ```sh
  npm install nocodb@2026.04.1
  ```


## Technical details

An SQL injection vulnerability exists in NocoDB's formula engine specifically affecting PostgreSQL backends. The root cause is located in 'packages/nocodb/src/db/functionMappings/pg.ts', where the 'ARRAYSORT' function fails to validate the 'direction' argument. This user-supplied value is passed through a 'sanitize' function that only escapes placeholders and is then embedded into a 'knex.raw' ORDER BY clause. An authenticated attacker with 'columnAdd' permissions (typically Creator or Owner roles) can provide a malicious SQL payload that executes during column creation and on every subsequent record read. This can be used to perform Denial of Service (DoS) via heavy queries or potentially broader SQL injection depending on database permissions.

## Affected products

- nocodb NocoDB < 2026.04.1

## Identifiers

- CVE-2026-47375
- GHSA-cxv7-gmmp-228p

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026.04.1: patched

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-cxv7-gmmp-228p](https://github.com/nocodb/nocodb/security/advisories/GHSA-cxv7-gmmp-228p)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)