CVE-2026-47375: NocoDB SQL Injection Vulnerability

CVE-2026-47375 Overview

CVE-2026-47375 is a SQL injection vulnerability [CWE-89] in NocoDB, an open-source platform for building databases as spreadsheets. The flaw exists in the Postgres formula mapping for the ARRAYSORT() function defined in packages/nocodb/src/db/functionMappings/pg.ts. An authenticated user with columnAdd permission can supply a malicious value to the optional direction argument, which is concatenated into a knex.rawORDER BY clause without validation. The injected SQL executes during column creation and on every subsequent read of the formula column. The vulnerability affects NocoDB versions prior to 2026.04.1.

Critical Impact
Authenticated users with column creation rights can execute arbitrary SQL against the Postgres backend, leading to data disclosure, tampering, and potential database denial of service.

Affected Products

NocoDB versions prior to 2026.04.1
Deployments using a PostgreSQL backend database
Instances exposing the ARRAYSORT formula function to users with columnAdd permission

Discovery Timeline

2026-06-23 - CVE-2026-47375 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47375

Vulnerability Analysis

NocoDB exposes a formula engine that lets users construct calculated columns using a defined set of functions. The ARRAYSORT(array, direction) function accepts an optional direction argument controlling ascending or descending order. On Postgres backends, the mapping in packages/nocodb/src/db/functionMappings/pg.ts embeds the supplied direction value directly into a knex.rawORDER BY clause.

Formula validation does not constrain the direction argument to an allowlist such as ASC or DESC. An attacker can place arbitrary SQL fragments into this argument. The malicious payload is then passed through knex.raw, bypassing parameterization, and executed by the Postgres server.

The injected SQL runs at two points: when the formula column is created and on every record read that evaluates the formula. This persistent execution path makes the vulnerability reliable for repeated data exfiltration or modification.

Root Cause

The root cause is unsafe string interpolation into a raw query builder. The Postgres function mapping treats the user-supplied direction token as trusted SQL syntax rather than as a value requiring strict validation. No allowlist check restricts the token to ASC or DESC.

Attack Vector

Exploitation requires an authenticated account with columnAdd permission on a Postgres-backed base. The attacker creates or modifies a formula column that invokes ARRAYSORT() with a crafted second argument containing SQL syntax. Once the column is saved, the embedded payload runs in the database session used by NocoDB to render the column, allowing the attacker to alter query semantics, read data from other tables, or trigger high-cost operations.

Detailed technical information is available in the GitHub Security Advisory GHSA-cxv7-gmmp-228p.

Detection Methods for CVE-2026-47375

Indicators of Compromise

Formula column definitions containing ARRAYSORT with a direction argument that is not exactly ASC or DESC.
Unexpected ORDER BY clauses in Postgres query logs originating from the NocoDB application user.
Postgres errors referencing syntax near user-controlled tokens in ORDER BY clauses on NocoDB-managed tables.
New or modified formula columns created by accounts that do not normally perform schema changes.

Detection Strategies

Audit the NocoDB metadata database for formula column definitions and flag any ARRAYSORT usage whose direction parameter contains characters outside [A-Za-z].
Enable Postgres log_statement = 'all' on non-production tiers and search for ORDER BY clauses containing subqueries, semicolons, or pg_ function references issued by the NocoDB role.
Correlate NocoDB application logs of column creation events with Postgres statement logs to identify malformed formula compilations.

Monitoring Recommendations

Monitor NocoDB audit events for columnAdd and column update actions, especially by non-administrative users.
Alert on outbound network connections from the Postgres host that do not match expected baselines, in case payloads leverage COPY ... PROGRAM or extensions.
Track query execution time and error rates on NocoDB-managed tables to detect injected payloads causing denial of service.

How to Mitigate CVE-2026-47375

Immediate Actions Required

Upgrade NocoDB to version 2026.04.1 or later, which contains the official fix.
Review all existing formula columns that reference ARRAYSORT and remove or rewrite any with non-standard direction values.
Restrict columnAdd permission to trusted administrators until the upgrade is complete.
Rotate database credentials used by NocoDB if exploitation is suspected.

Patch Information

The maintainers fixed the issue in NocoDB 2026.04.1 by constraining the direction argument in the Postgres mapping of ARRAYSORT. Refer to the GitHub Security Advisory GHSA-cxv7-gmmp-228p for the upstream patch details and version notes.

Workarounds

Temporarily revoke columnAdd permission from non-administrative roles on Postgres-backed bases.
Disable use of the ARRAYSORT function in user-authored formulas where feasible by reviewing and removing such columns.
Run the NocoDB Postgres role with the least privileges required, denying access to unrelated schemas and disabling superuser rights.

bash

# Example: restrict the NocoDB Postgres role to its own schema
REVOKE ALL ON SCHEMA public FROM nocodb_app;
GRANT USAGE ON SCHEMA nocodb TO nocodb_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA nocodb TO nocodb_app;
ALTER ROLE nocodb_app NOSUPERUSER NOCREATEDB NOCREATEROLE;