CVE-2026-47387 Overview
CVE-2026-47387 is a stored cross-site scripting (XSS) vulnerability in NocoDB, an open-source platform that turns databases into spreadsheet-like interfaces. The flaw exists in the shared form-view submit handler located at packages/nc-gui/composables/useSharedFormViewStore.ts. The handler writes the form's redirect_url to window.location.href after a same-host check, but it fails to validate the URL scheme. A user with editor role or above can plant a javascript: URL in redirect_url. When an authenticated viewer submits the shared form, the payload executes in the NocoDB origin and can exfiltrate the session token from localStorage["nocodb-gui-v2"]. The vulnerability is tracked as [CWE-79] and is fixed in version 2026.05.1.
Critical Impact
Successful exploitation enables session token theft from authenticated NocoDB users, leading to full account takeover within the application origin.
Affected Products
- NocoDB versions prior to 2026.05.1
- Shared form-view feature in nc-gui package
- All deployments exposing shared form links to authenticated users
Discovery Timeline
- 2026-06-23 - CVE-2026-47387 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-47387
Vulnerability Analysis
The vulnerability resides in the shared form-view submit logic implemented in useSharedFormViewStore.ts. After a viewer submits a shared form, NocoDB redirects the browser to the URL stored in the form's redirect_url field. The code performs a same-host validation to restrict cross-origin redirects but does not inspect the URL scheme. As a result, pseudo-protocol values such as javascript: pass the check and reach window.location.href, where the browser executes the payload in the NocoDB document context.
An attacker holding editor privileges on any base can persist a malicious redirect_url. The payload activates only when a victim opens the shared form link and completes a submission, satisfying the user interaction requirement. Because the script runs in the NocoDB origin, it can read localStorage["nocodb-gui-v2"], which stores the authenticated session token, and forward it to an attacker-controlled endpoint.
Root Cause
The root cause is missing input validation on the URL scheme component of redirect_url. The same-host check confirms the host portion but treats javascript: URIs as acceptable navigation targets. Assigning untrusted, scheme-unvalidated input to window.location.href is a classic sink for stored XSS in single-page applications.
Attack Vector
The attack requires network access to the NocoDB instance and low-privilege editor credentials. A privileged user configures a shared form view and sets redirect_url to a javascript: payload that reads the session token from local storage. The attacker then distributes the share link to higher-privilege users. When a victim submits the form, the payload runs with the victim's session, enabling token theft and lateral access within NocoDB. Exploitation does not require any vulnerability in the victim's browser configuration.
Detection Methods for CVE-2026-47387
Indicators of Compromise
- Shared form view records containing redirect_url values that begin with javascript:, data:, or vbscript: schemes.
- Outbound browser requests to unfamiliar domains immediately following submissions to NocoDB shared form links.
- Unexpected reuse of NocoDB session tokens from IP addresses or user agents that differ from the legitimate session origin.
Detection Strategies
- Query the NocoDB metadata database for any form view configurations where redirect_url does not start with http:// or https://.
- Inspect web server and reverse proxy access logs for shared form submission endpoints followed by anomalous referer chains.
- Audit role assignments to identify accounts with editor or higher privileges across bases and review their recent form view modifications.
Monitoring Recommendations
- Enable application-level audit logging for changes to shared form view definitions, including redirect_url fields.
- Forward NocoDB and reverse proxy logs to a centralized analytics platform and alert on javascript: strings in stored configuration values.
- Monitor authentication events for session reuse patterns that suggest token theft, such as concurrent sessions from disparate geographies.
How to Mitigate CVE-2026-47387
Immediate Actions Required
- Upgrade all NocoDB instances to version 2026.05.1 or later.
- Audit existing shared form views and remove any redirect_url value that is not an http:// or https:// URL.
- Rotate NocoDB session tokens and force re-authentication for users who may have interacted with suspect shared forms.
Patch Information
The maintainers fixed the issue in NocoDB 2026.05.1 by adding scheme validation to the shared form-view submit handler. See the GitHub Security Advisory GHSA-hj85-ph9q-78jg for the official patch details.
Workarounds
- Restrict editor and higher roles to trusted users only until the patch is applied.
- Disable shared form views in environments where upgrading immediately is not feasible.
- Deploy a Content Security Policy (CSP) that disallows inline script execution to reduce the impact of XSS payloads.
# Upgrade NocoDB to the patched release
npm install -g nocodb@2026.05.1
# Or, for Docker deployments
docker pull nocodb/nocodb:2026.05.1
docker stop nocodb && docker rm nocodb
docker run -d --name nocodb -p 8080:8080 nocodb/nocodb:2026.05.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
