CVE-2026-47387: NocoDB stored XSS in shared form-view redirect URL

CVE-2026-47387 · Severity: high · CVSS 4 · Published 2026-06-23

NocoDB is an open-source platform that turns databases into smart spreadsheets. A security flaw allows users with 'editor' permissions to embed malicious scripts into form redirect links. If another user clicks this link and submits the form, the attacker can steal their login session token and perform actions on their behalf, potentially compromising sensitive database information.

Technologies: nocodb (npm). Vendors: npm.

Quick answers

Is CVE-2026-47387 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47387 being exploited in the wild.
How severe is CVE-2026-47387?
High severity, with a CVSS score of 4, published 23 June 2026.
Which products and versions are affected?
nocodb (npm) <= 2026.05.0, ECOSYSTEM:introduced=0,fixed=2026.05.1.
Is there a fix for CVE-2026-47387?
Yes. nocodb (npm): upgrade to 2026.05.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47387 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-47387?
Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nocodb (npm): upgrade to 2026.05.1 or later
    npm install nocodb@2026.05.1

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in NocoDB's shared form-view submit handler within 'useSharedFormViewStore.ts'. The application fails to validate the URL scheme of the 'redirect_url' parameter, checking only if the host matches. An attacker with 'editor' privileges can inject a 'javascript:' URI into the redirect field. When a victim visits the shared form and submits it, the malicious script executes in the context of the NocoDB origin. This allows the attacker to access the victim's session token stored in 'localStorage' and perform authenticated API calls. The issue is resolved in version 2026.05.1.

Affected products

  • NocoDB NocoDB < 2026.05.1

Identifiers

  • CVE-2026-47387
  • GHSA-hj85-ph9q-78jg

Timeline

  • 2026-06-04: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD
  • 2026-05-01: patched: Fixed in version 2026.05.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.