by Kastro
Paper/Archive/CVE-2026-126274

CVE-2026-126274

nocodb nocodb — NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog

CVSS 9.3
critical.is priorityof 100
28
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

Affected

ProductAffectedFixed inSource
nocodb< 2026.08.02026.08.0CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
VulnCheck (CNA)8.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

advisorygithub.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9xwriteupvulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog