CVE-2026-126274 · Other
NO FIX YET · SEE WHAT TO DO
NocoDB before 2026.08.0 renders column and table titles through an unescaped innerHTML binding in its delete confirmation dialog. An authenticated Creator can embed script in a title, which runs when a victim deletes an external-source table and lets the attacker steal session tokens from localStorage.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or managed NocoDB instances before 2026.08.0 where users hold the Creator role and other users delete external-source tables. Instances where only trusted users can create tables, or that are already on 2026.08.0 or later, are not exposed.
Not affected if creator-role-restricted, version-2026.08.0-or-later
Who cares low-code, nocodb, self-hosted
2026.08.0 are in the affected range.2026.08.0 or later.NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.