CVE-2026-47387: NocoDB: Stored Cross-Site Scripting via Form View Redirect URL

June 5, 2026 (updated July 20, 2026)

The shared form-view submit handler in NocoDB writes the form’s redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form’s redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"].

References

github.com/advisories/GHSA-hj85-ph9q-78jg
github.com/nocodb/nocodb/releases/tag/2026.05.1
github.com/nocodb/nocodb/security/advisories/GHSA-hj85-ph9q-78jg
nvd.nist.gov/vuln/detail/CVE-2026-47387

Code Behaviors & Features

Detect and mitigate CVE-2026-47387 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →