CVE-2026-126279: NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip
NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.06.2
Event History
Frequently Asked Questions
Who can exploit this issue and what user action triggers it?
An attacker needs the Creator role or higher to store malicious markup in an AI field prompt's field reference. The payload executes when another user opens the affected field's configuration and the tooltip is rendered.
What can an attacker do after successful exploitation?
The attacker can steal the victim's localStorage session token. That token can then be used to call authenticated APIs as the victim.
Which versions need remediation?
NocoDB versions before 2026.06.2 are affected. Upgrade to 2026.06.2 or later.