CVE-2026-47383

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description An authenticated commenter can store HTML in row comments that executes as a script when other users hover over the comment in the expanded form view. This occurs because comment write paths persist the raw comment body without server-side sanitization. The expanded-form sidebar renders the stored body and passes its data-tooltip attribute to Tippy with allowHTML: true. Consequently, attribute-level payloads re-enter the Document Object Model (DOM)—the programming interface for HTML and XML documents—as live HTML on hover, even if script tags were stripped during the initial write. This allows for Stored Cross-Site Scripting (XSS), where a script runs in the NocoDB origin using the victim's session, potentially allowing the reading of the authentication JSON Web Token (JWT) from localStorage.

Recommendations Update to version 2026.05.1.