CVE-2026-47375: NocoDB Postgres SQL Injection via ARRAYSORT Direction Parameter

Technical summary

The vulnerability exists in NocoDB's formula engine, specifically in the Postgres-specific ARRAYSORT function implementation located in packages/nocodb/src/db/functionMappings/pg.ts. The direction argument of ARRAYSORT is passed directly into a knex.raw ORDER BY clause without validation or sanitization by the formula engine. Because the value is embedded unescaped into the SQL query, an authenticated user with columnAdd permissions can craft a direction parameter containing arbitrary SQL syntax. The injected SQL executes immediately during column creation and re-executes on every subsequent read operation against that formula column, creating a persistent code execution vector. The vulnerability is specific to Postgres backends; other database mappings are not affected.

Business impact

Organizations using NocoDB with Postgres backends face data exposure and manipulation risks from internal users. An attacker with column-creation privileges—whether a malicious employee, contractor, or compromised account—can read sensitive data, modify records, or corrupt the database without leaving obvious traces in application logs. The persistent nature of the injection means each record read triggers the malicious SQL, enabling exfiltration of large datasets or gradual data poisoning. Incident response becomes complex because the attack executes through normal application queries rather than direct database access.

Affected systems

NocoDB versions prior to 2026.04.1 using Postgres as the database backend are vulnerable. The attack requires authenticated access with columnAdd permission, which is typically granted to collaborators with editing rights on a shared base. Self-hosted and cloud instances are both affected if running vulnerable versions. Non-Postgres databases (MySQL, SQLite, etc.) are not affected by this specific vulnerability.

Exploitability

Exploitation requires valid NocoDB credentials and columnAdd permissions, setting a relatively high barrier compared to unauthenticated exploits. However, within organizations using NocoDB for collaborative data work, column-creation access is often broadly distributed. The attack is straightforward to execute—an attacker simply creates or modifies a column with a crafted ARRAYSORT formula—and requires no complex tooling or timing. The CVSS score of 6.0 (MEDIUM) reflects this authentication prerequisite, though the impact on confidentiality, integrity, and availability once inside is notable.

Remediation

Upgrade NocoDB to version 2026.04.1 or later. This version includes validation and proper parameterization of the ARRAYSORT direction argument, preventing SQL injection. Verify the upgrade applies to your deployment method (cloud-hosted, self-hosted Docker, npm installation, etc.). After upgrading, audit existing columns using ARRAYSORT formulas for any suspicious direction parameters, particularly if columnAdd activity has been unusual.

Patch guidance

Apply NocoDB 2026.04.1 or later. If running NocoDB in a containerized environment, pull the latest image and redeploy. For self-hosted npm installations, run npm update nocodb to the patched version. For cloud instances, verify your platform auto-updates or manually trigger an upgrade. Test in a non-production environment first to confirm application compatibility. No data migration is required; the patch only affects the formula validation logic.

Detection guidance

Review NocoDB audit logs for columnAdd operations, particularly those using ARRAYSORT with unusual direction values containing SQL keywords (SELECT, UNION, ';', '--', etc.). Monitor Postgres query logs for unexpected commands originating from NocoDB connections during column creation or record reads. Inspect existing formula columns in your bases for suspicious ARRAYSORT configurations. Network-level detection is difficult since malicious queries appear as legitimate database traffic; focus on access control review and formula auditing.

Why prioritize this

Although labeled MEDIUM severity, this vulnerability warrants prompt attention for any organization using NocoDB with Postgres and collaborative editing. The attack surface is internal (requires authentication and specific permissions) but the persistence of injected code and the potential for wide data access make it a material insider risk. Organizations with restrictive column-creation policies or limited Postgres data sensitivity may deprioritize slightly; those with broad sharing or sensitive databases should patch within standard patch windows.

Risk score, explained

The CVSS 3.1 score of 6.0 reflects a high-impact vulnerability (data confidentiality, integrity, and availability all affected as indicated by the vector) tempered by authentication and high-privilege requirements (PR:H). The network-accessible attack vector (AV:N) acknowledges that the exploit is delivered remotely, but the prerequisites of valid credentials and column-add permissions prevent casual exploitation. The complete lack of user interaction (UI:N) and unchanged security scope (S:U) acknowledge that no social engineering or privilege escalation is needed once the attacker has the required role.

Frequently asked questions