CVE-2026-47375
Description
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). The value is unrestricted by formula validation and embedded into a knex.raw ORDER BY clause, executing during column creation and on every subsequent record read of the formula column. The vulnerability is specific to the Postgres mapping for ARRAYSORT in packages/nocodb/src/db/functionMappings/pg.ts. This vulnerability is fixed in 2026.04.1.
Summary dbcve.org
Authenticated SQL injection in NocoDB's ARRAYSORT function for Postgres databases. The optional direction argument is not validated and gets directly embedded into a knex.raw ORDER BY clause during column creation and on every record read of the formula column, allowing arbitrary SQL execution.
Mitigation
Upgrade to NocoDB version 2026.04.1 or later. If immediate upgrade is not feasible, restrict or revoke columnAdd permission for Postgres-backed bases until the patch can be applied.