XSS in Nocodb

CVE-2026-47383

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The com…

Vulnerability class: XSS (Cross-Site Scripting)

Affected products

  • Nocodb — versions < 2026.05.1

Weakness classification (CWE)

References