p PatchFirst

CVE-2026-47387

CVE-2026-47387 · NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form's redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"]. This vulnerability is fixed in 2026.05.1.

CVSS 8.4 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • nocodb

    Versions
    • < 2026.05.1: Affected

    No fix published

  • nocodb npm

    Affected ranges
    • ECOSYSTEM: < 2026.05.1

    Update to 2026.05.1

Original sources

Check your server →