HTML Injection in NocoDB Affects User Interaction

CVE-2026-47383

What is CVE-2026-47383?

NocoDB, a platform designed to build databases resembling spreadsheets, is affected by a vulnerability that allows authenticated commenters to inject HTML into row comments. This HTML is executed as JavaScript when other users hover over these comments in the expanded view. The vulnerability arises from insufficient server-side sanitization, which permits the storage of raw comment inputs. Consequently, even if the editor attempts to sanitize inputs by stripping script tags, malicious payloads can still manifest as live HTML upon hover, compromising user safety and data integrity. This issue has been addressed in version 2026.05.1.

References