Stored Cross-Site Scripting Vulnerability in NocoDB by NocoDB

CVE-2026-126274

What is CVE-2026-126274?

NocoDB before 2026.08.0 is susceptible to a stored cross-site scripting vulnerability. This flaw allows authenticated Creator users to inject malicious scripts via markup in column or table titles. The issue arises when the Delete.vue confirmation dialog utilizes an unescaped innerHTML binding to render these titles. Consequently, when a user deletes an external-source table, the injected script can execute, potentially leading to the theft of session tokens from the user's localStorage.

References