CVE-2026-47383: NocoDB Stored XSS Vulnerability

CVE-2026-47383 Overview

CVE-2026-47383 is a stored cross-site scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. Versions prior to 2026.05.1 accept HTML in row comments without server-side sanitization. The stored payload executes when another user hovers over the comment in the expanded form view. The flaw maps to CWE-79: Improper Neutralization of Input During Web Page Generation. An authenticated commenter can persist a malicious payload that triggers in the browser of any user viewing the affected record.

Critical Impact
An authenticated low-privilege commenter can execute arbitrary JavaScript in another user's session, leading to account takeover, data exfiltration, or workspace compromise.

Affected Products

NocoDB versions prior to 2026.05.1
NocoDB self-hosted deployments exposing the expanded form view
NocoDB instances permitting authenticated comment write access

Discovery Timeline

2026-06-23 - CVE-2026-47383 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-47383

Vulnerability Analysis

The vulnerability resides in the comment write paths of NocoDB. The server persists raw comment bodies without HTML sanitization. When the expanded-form sidebar renders the stored comment, it passes the comment body to the data-tooltip attribute consumed by the Tippy.js tooltip library. Tippy is initialized with allowHTML: true, which instructs the library to parse and inject the attribute value as live DOM. The frontend editor strips <script> tags at write time, but this client-side filter is insufficient. Attribute-level event handlers such as onerror, onload, and onmouseover bypass the filter and reach the DOM intact. Hovering the comment triggers Tippy to render the payload, causing script execution in the victim's authenticated session.

Root Cause

The root cause is missing output encoding combined with an unsafe Tippy configuration. The server trusts client-supplied HTML, and the renderer opts into raw HTML parsing via allowHTML: true. No contextual escaping is applied before the body enters the tooltip attribute.

Attack Vector

An authenticated user with commenter privileges submits a row comment containing an HTML element with an event-handler attribute. The payload is stored as-is. When any other user opens the expanded form view for the affected row and hovers the comment, Tippy injects the payload, and the attacker's script executes under the victim's origin and session cookies.

No verified public proof-of-concept code is available. See the NocoDB GitHub Security Advisory GHSA-jf3g-4gwg-4h66 for vendor technical details.

Detection Methods for CVE-2026-47383

Indicators of Compromise

Row comment records containing HTML attributes such as onerror=, onmouseover=, onload=, or onfocus= in the comment body field
Browser console errors or unexpected outbound requests originating from the NocoDB expanded form view
Unexpected session token or API key requests to NocoDB endpoints sourced from authenticated user browsers

Detection Strategies

Query the comments table for stored bodies matching regular expressions targeting HTML event handlers and javascript: URIs
Review application logs for comment create and update operations from low-privilege accounts that contain angle brackets or attribute syntax
Inspect Content Security Policy (CSP) violation reports for inline script or event handler executions on form view routes

Monitoring Recommendations

Alert on anomalous API calls originating from authenticated browser sessions immediately after expanded form view access
Track comment authoring patterns by user role, flagging accounts that generate HTML-laden payloads
Monitor for privilege changes or token issuance events following sessions that interacted with affected records

How to Mitigate CVE-2026-47383

Immediate Actions Required

Upgrade NocoDB to version 2026.05.1 or later, which sanitizes comment bodies and removes raw HTML rendering in the tooltip
Audit existing row comments for stored HTML payloads and purge any malicious entries before exposing the upgraded instance
Rotate session tokens and API keys for users who may have viewed compromised records

Patch Information

The vulnerability is fixed in NocoDB 2026.05.1. The patched release sanitizes the comment body on write and removes the allowHTML: true Tippy configuration on the expanded-form sidebar. Refer to the NocoDB GitHub Security Advisory GHSA-jf3g-4gwg-4h66 for upgrade guidance.

Workarounds

Restrict comment permissions to trusted users until the patch is applied
Deploy a strict Content Security Policy that disallows inline event handlers and unsafe-inline script sources on NocoDB routes
Place NocoDB behind a web application firewall rule that blocks comment payloads containing HTML event-handler attributes

bash

# Upgrade NocoDB to the patched release
docker pull nocodb/nocodb:2026.05.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb -p 8080:8080 \
  -v nocodb_data:/usr/app/data \
  nocodb/nocodb:2026.05.1