CVE-2026-47387: NocoDB Stored Cross-Site Scripting via Form View Redirect URL
Summary
CVE-2026-47387: NocoDB: Stored Cross-Site Scripting via Form View Redirect URL. Affects nocodb versions < 2026.05.1. Fixed in 2026.05.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, enabling users to manage data easily without needing extensive coding knowledge. It provides features such as form views, data sharing, and collaboration tools. However, a vulnerability has been identified in its form-view submit handler, which can be exploited by users with editor roles to execute malicious scripts.
Vulnerability Detail
The vulnerability arises from the shared form-view submit handler in NocoDB, which writes the form's redirect_url to window.location.href without properly validating the URL scheme. This allows a user with an editor role to insert a javascript: URL into the redirect_url field. When an authenticated viewer submits the form via a shared link, the malicious script executes in the NocoDB origin, enabling the attacker to read the session token from localStorage. This can lead to unauthorized actions under the viewer's identity, as the attacker can call authenticated APIs with the viewer's permissions.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.05.1
This is the first release that contains the fix.
npm install nocodb@2026.05.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the form-view PATCH endpoint to only trusted users and validate the redirect_url on the client-side to ensure it does not contain any harmful schemes.
Conclusion
In summary, the vulnerability CVE-2026-47387 in NocoDB allows for stored cross-site scripting through the form view redirect URL. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for nocodb →
FAQ
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
Any user with an editor role on the NocoDB base can exploit this vulnerability by crafting a malicious redirect_url.
The potential impacts include unauthorized access to the viewer's session token and the ability to perform actions as the viewer, which can lead to data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
If you cannot update the package immediately, implement the suggested workaround to restrict access and validate redirect URLs until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
