Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form's redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"]. This vulnerability is fixed in 2026.05.1.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-47387?
CVE-2026-47387 is a documented vulnerability. NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form's r...
How severe is CVE-2026-47387?
CVSS scoring is not yet available for CVE-2026-47387. Check NVD for updates.
Is there a patch for CVE-2026-47387?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.