# CVE-2026-47384: NocoDB SQL injection in bulk groupBy via column title

Source: https://junglewise.ai/threats/cve-2026-47384-nocodb-sql-injection-in-bulk-groupby-via-column-title  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-47384 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform that turns databases into smart spreadsheets, is vulnerable to a security flaw that allows certain users to run unauthorized database commands. An attacker with permissions to create or rename columns could use a specially crafted column title to access or modify data they shouldn't see. This could lead to unauthorized data exposure or minor data manipulation within the connected database.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-47384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47384 being exploited in the wild.

**How severe is CVE-2026-47384?** Medium severity, with a CVSS score of 4, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) <= 2026.05.0, ECOSYSTEM:introduced=0,fixed=2026.05.1.

**Is there a fix for CVE-2026-47384?** Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47384 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47384?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nocodb (npm): upgrade to 2026.05.1 or later

  ```sh
  npm install nocodb@2026.05.1
  ```


## Technical details

A SQL injection vulnerability exists in NocoDB's bulk groupBy endpoint due to improper neutralization of user-supplied column titles. The 'group-by.ts' component utilizes 'knex.raw()' to build database aggregations, directly interpolating the 'column_name' into the SQL string. Because the column lookup logic in 'data-table.service.ts' matches against both sanitized names and free-text titles, an attacker can bypass existing allowlists by embedding SQL fragments in a column title. Exploitation requires network access and an authenticated session with 'column-create' or rename permissions. This allows for arbitrary SQL execution against the underlying database, primarily impacting data confidentiality and integrity.

## Affected products

- nocodb nocodb < 2026.05.1

## Identifiers

- CVE-2026-47384
- GHSA-p8wx-5f39-w3x4

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-05-01: patched: Vulnerability fixed in version 2026.05.1
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-p8wx-5f39-w3x4](https://github.com/nocodb/nocodb/security/advisories/GHSA-p8wx-5f39-w3x4)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB stored cross-site scripting in secure attachments](https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)