CVE-2026-126274: NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and what interaction is required?
An authenticated user with the Creator role can inject malicious markup into a column or table title. The payload executes when another user deletes an external-source table and the deletion confirmation dialog renders the crafted title.
Are all table deletions affected?
The described execution path is specifically the confirmation dialog used when deleting an external-source table. The provided information does not establish that deletion dialogs for other table types are affected.
What is the impact if exploitation succeeds?
Injected script can execute in the victim's browser and steal session tokens stored in localStorage. The vulnerability is rated critical with a 9.3 score and has scope, confidentiality, and integrity impacts.
Which versions need remediation?
NocoDB versions before 2026.08.0 are affected. Upgrading to 2026.08.0 or later addresses the stated affected-version range.