Stored Cross-Site Scripting in NocoDB Affects User Security

CVE-2026-126269

What is CVE-2026-126269?

NocoDB versions prior to 2026.09.0 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated Editor users to execute malicious scripts. This is achieved by exploiting crafted attachment MIME types that can be uploaded via the records API. When a user accesses a specific signed URL, the server can serve HTML payloads inline, potentially exposing session tokens stored in localStorage. This vulnerability poses significant risks to user account integrity and data privacy, making it crucial for users to upgrade to the latest version to mitigate these security threats.

References