CVE-2026-47383: NocoDB Stored Cross-Site Scripting Vulnerability via Row Comments
Summary
CVE-2026-47383: NocoDB: Stored Cross-Site Scripting via Row Comments. Affects nocodb versions < 2026.05.1. Fixed in 2026.05.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, enabling users to manage data efficiently. It allows for collaborative commenting on rows, which enhances user interaction. However, this feature has a vulnerability that permits authenticated users to inject malicious HTML into comments, leading to potential security risks.
Vulnerability Detail
The vulnerability arises from the lack of server-side sanitization when storing comments. Authenticated users can input HTML into row comments, which is then rendered as live HTML when other users hover over the comment in the expanded view. This can lead to Stored Cross-Site Scripting (XSS), allowing attackers to execute scripts in the context of other users' sessions, potentially compromising sensitive information such as authentication tokens stored in local storage.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.05.1
This is the first release that contains the fix.
npm install nocodb@2026.05.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the commenting feature until the package is updated. This can be done by modifying the application settings to restrict comment functionality.
Conclusion
In summary, the CVE-2026-47383 vulnerability in NocoDB allows for Stored Cross-Site Scripting through row comments, posing significant risks to user data. It is crucial to update to the patched version to safeguard against potential attacks.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability is a Stored Cross-Site Scripting (XSS) issue that allows attackers to inject malicious scripts through row comments.
Any user who views the affected row with the malicious comment is at risk, especially if they are authenticated.
You can use Vulert to monitor your application for vulnerabilities. Simply upload your package-lock.json file to receive real-time alerts.
The CVSS score for this vulnerability is 7.4, indicating a high severity level.
Yes, temporarily disabling the commenting feature can mitigate the risk until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
