CVE-2026-47375: NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`

June 5, 2026 (updated July 20, 2026)

An authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). The value is unrestricted by formula validation and embedded into a knex.raw ORDER BY clause, executing during column creation and on every subsequent record read of the formula column.

References

github.com/advisories/GHSA-cxv7-gmmp-228p
github.com/nocodb/nocodb/releases/tag/2026.04.1
github.com/nocodb/nocodb/security/advisories/GHSA-cxv7-gmmp-228p
nvd.nist.gov/vuln/detail/CVE-2026-47375

Code Behaviors & Features

Detect and mitigate CVE-2026-47375 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →