CVE-2026-47375— NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
Quick assessment
Affected
nocodb nocodb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.04.1之前版本存在SQL注入漏洞，该漏洞源于通过ARRAYSORT(...)的可选direction参数输入验证不足，导致经过身份验证的用户可在Postgres后台上注入任意SQL语句，执行于列创建和后续列读取操作中。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47375
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
Source: CVE Program / CVE List V5
Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). The value is unrestricted by formula validation and embedded into a knex.raw ORDER BY clause, executing during column creation and on every subsequent record read of the formula column. The vulnerability is specific to the Postgres mapping for ARRAYSORT in packages/nocodb/src/db/functionMappings/pg.ts. This vulnerability is fixed in 2026.04.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
NocoDB SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NocoDB是nocodb公司开源的一个 Airtable 替代品。将任何 MySql、PostgreSql、Sql Server、Sqlite 和 MariaDb 转换为智能电子表格。 NocoDB 2026.04.1之前版本存在SQL注入漏洞，该漏洞源于通过ARRAYSORT(...)的可选direction参数输入验证不足，导致经过身份验证的用户可在Postgres后台上注入任意SQL语句，执行于列创建和后续列读取操作中。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-47375
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47375
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47375 (1)
Same Patch Batch · nocodb · 2026-06-23 · 29 CVEs total
| CVE-2026-46551 | 6.5 MEDIUM | NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk E |
| CVE-2026-46547 | 6.1 MEDIUM | NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL |
| CVE-2026-46552 | 5.8 MEDIUM | NocoDB: Shared-base link access can invite arbitrary users as persistent base members |
| CVE-2026-46550 | 5.4 MEDIUM | NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags |
| CVE-2026-46548 | 4.3 MEDIUM | NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost |
| CVE-2026-46549 | 2.0 LOW | NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation |
| CVE-2026-47377 | NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin | |
| CVE-2026-46553 | NocoDB: Attachment Size Limit Bypass via Upload-by-URL | |
| CVE-2026-46554 | NocoDB: Stale Auth Cache After API Token Deletion | |
| CVE-2026-47385 | NocoDB: Path Traversal via SQLite Source Filename | |
| CVE-2026-47382 | NocoDB: Server-Side Request Forgery via Database Connection Host | |
| CVE-2026-47376 | NocoDB: Reflected Cross-Site Scripting via Password Reset Token | |
| CVE-2026-47384 | NocoDB: SQL Injection via Column Title in Bulk GroupBy | |
| CVE-2026-47386 | NocoDB: OAuth Authorization Code Race Condition | |
| CVE-2026-53929 | NocoDB: Stored Cross-Site Scripting via Secure Attachment | |
| CVE-2026-47381 | NocoDB: Cross-Workspace Integration Use in Connection Test | |
| CVE-2026-47378 | NocoDB: Hidden Column Exposure in Public Shared View Endpoints | |
| CVE-2026-47379 | NocoDB: Plaintext Password Comparison in Shared Views | |
| CVE-2026-47388 | NocoDB: Missing Ownership Check in MCP Attachment Read | |
| CVE-2026-47387 | NocoDB: Stored Cross-Site Scripting via Form View Redirect URL |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same vendor: nocodb
-
CVE-2026-46547
NocoDB: Reflected Cross-Site Scripting via Page Leaving Redi -
CVE-2026-46548
NocoDB: SSRF Protection Bypass in Notification Webhook Plugi -
CVE-2026-46549
NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows S -
CVE-2026-46550
NocoDB: Refresh Token Cookie Set Without `Secure` and `SameS -
CVE-2026-46552
NocoDB: Shared-base link access can invite arbitrary users a
Same weakness: CWE-89
-
CVE-2026-102109
Kiteworks Secure Data Forms SQL injection -
CVE-2026-102098
Kiteworks Core SQL Injection -
CVE-2026-103232
AdithyaYelloju Restaurant-Management-System table_booking.ph -
CVE-2026-103231
AdithyaYelloju Restaurant-Management-System Order Cancellati -
CVE-2026-103230
AdithyaYelloju Restaurant-Management-System Order Placement
V. Comments for CVE-2026-47375
No comments yet