CVE-2026-47384: NocoDB SQL injection in bulk groupBy via column title

CVE-2026-47384 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform that turns databases into smart spreadsheets, is vulnerable to a security flaw that allows certain users to run unauthorized database commands. An attacker with permissions to create or rename columns could use a specially crafted column title to access or modify data they shouldn't see. This could lead to unauthorized data exposure or minor data manipulation within the connected database.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-47384 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47384 being exploited in the wild.
How severe is CVE-2026-47384?
Medium severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 2026.05.0, ECOSYSTEM:introduced=0,fixed=2026.05.1.
Is there a fix for CVE-2026-47384?
Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47384 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47384?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nocodb (npm): upgrade to 2026.05.1 or later
    npm install nocodb@2026.05.1

Technical details

A SQL injection vulnerability exists in NocoDB's bulk groupBy endpoint due to improper neutralization of user-supplied column titles. The 'group-by.ts' component utilizes 'knex.raw()' to build database aggregations, directly interpolating the 'column_name' into the SQL string. Because the column lookup logic in 'data-table.service.ts' matches against both sanitized names and free-text titles, an attacker can bypass existing allowlists by embedding SQL fragments in a column title. Exploitation requires network access and an authenticated session with 'column-create' or rename permissions. This allows for arbitrary SQL execution against the underlying database, primarily impacting data confidentiality and integrity.

Affected products

  • nocodb nocodb < 2026.05.1

Identifiers

  • CVE-2026-47384
  • GHSA-p8wx-5f39-w3x4

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published
  • 2026-05-01: patched: Vulnerability fixed in version 2026.05.1
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.