CVE-2026-126269: NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type

Q: What level of access does an attacker need to exploit this issue?

The attacker must be authenticated as an Editor and able to write records through the records API. Exploitation also requires a victim to interact with the stored content.

Q: What is the practical impact of successful exploitation?

A crafted attachment MIME type can cause the /dltemp signed URL to serve attacker-controlled HTML inline. The resulting script can steal session tokens from localStorage and impersonate the victim.

Q: Which versions require remediation?

NocoDB versions before 2026.09.0 are affected. Upgrade to 2026.09.0 or later.

Published Nov 13, 2026

Updated

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims.

Affected Software

1 affected component

NocoDB NocoDB<2026.09.0

Event History

Nov 13, 2026

CVE Published

via MITRE·09:36 AM

Data Sourced

via MITRE·09:36 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be authenticated as an Editor and able to write records through the records API. Exploitation also requires a victim to interact with the stored content.

What is the practical impact of successful exploitation?

A crafted attachment MIME type can cause the /dltemp signed URL to serve attacker-controlled HTML inline. The resulting script can steal session tokens from localStorage and impersonate the victim.

Which versions require remediation?