CVE-2026-47383Disclosure

LOWCVSS 7.4 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths persisted the raw comment body with no server-side sanitisation; the expanded-form sidebar then rendered the stored body and fed its data-tooltip attribute to Tippy with allowHTML: true. Even when the editor stripped script tags at write time, attribute-level payloads re-entered the DOM as live HTML on hover. This vulnerability is fixed in 2026.05.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/nocodb/nocodb/security/advisories/GHSA-jf3g-4gwg-4h66

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-47383 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script whe… https://www.cve.org/CVERecord?id=CVE-2026-47383 ----- Traducción: CVE-2026-47383 Noc… http://infoflow.cloud`
Post summary
The post announces CVE-2026-47383, detailing an XSS vulnerability in NocoDB where authenticated commenters can execute scripts via stored HTML in comments before version 2026.05.1.
0000028
88 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-47383 NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script whe… https://www.cve.org/CVERecord?id=CVE-2026-47383
Post summary
CVE-2026-47383 describes a stored XSS vulnerability in NocoDB prior to version 2026.05.1 that lets authenticated users inject and run scripts via row comments. No exploit evidence, remediation, or PoC is provided in the text.
00000639
57.7K followersView on X

Explore more

Back to dashboard