{"id":"CVE-2026-126274","kind":"vulnerability","aliases":["CVE-2026-126274"],"related":[],"title":"NocoDB: stored XSS in table titles steals session tokens","description":"NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.","summary":"NocoDB before 2026.08.0 renders column and table titles through an unescaped innerHTML binding in its delete confirmation dialog. An authenticated Creator can embed script in a title, which runs when a victim deletes an external-source table and lets the attacker steal session tokens from localStorage.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["low-code","nocodb","other","self-hosted"],"not_affected_if":["creator-role-restricted","version-2026.08.0-or-later"],"how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are in the affected range.\n- Review who holds the Creator role, since they can set table and column titles.","fix":"- NocoDB: move to `2026.08.0` or later.","status":"open","published_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","triaged_at":"2026-11-13T10:48:24+00:00","updated_at":"2026-11-13T10:48:24+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-13T10:48:24Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: move to `2026.08.0` or later.","reach":"internet","title":"NocoDB: stored XSS in table titles steals session tokens","impact":"high","summary":"NocoDB before 2026.08.0 renders column and table titles through an unescaped innerHTML binding in its delete confirmation dialog. An authenticated Creator can embed script in a title, which runs when a victim deletes an external-source table and lets the attacker steal session tokens from localStorage.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nocodb","self-hosted","low-code"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Session tokens of other users are stolen through injected script.","analyst_note":"NocoDB product data gives no affected products list; confirm the version range against the vendor advisory on GitHub.\n","how_to_check":"- Check the NocoDB version in use; versions before `2026.08.0` are in the affected range.\n- Review who holds the Creator role, since they can set table and column titles.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2026.08.0-or-later","creator-role-restricted"],"who_is_affected":"Self-hosted or managed NocoDB instances before 2026.08.0 where users hold the Creator role and other users delete external-source tables. Instances where only trusted users can create tables, or that are already on 2026.08.0 or later, are not exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000735,"input_tokens":4618,"output_tokens":547,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126274':12A,15A '-2026':11A,14A '2026.08.0':26B,73C 'allow':83C 'attack':65B 'authent':43B,84C 'bind':36B,109C 'code':18B 'column':28B,94C 'confirm':40B,100C 'contain':74C 'creator':44B,85C 'cross':78C 'cross-sit':77C 'cve':10A,13A 'delet':39B,56B,115C 'delete.vue':99C 'dialog':41B,101C 'emb':46B 'embed':91C 'execut':110C 'extern':59B,118C 'external-sourc':58B,117C 'host':23B 'inject':88C 'innerhtml':35B,108C 'let':63B 'localstorag':70B,126C 'low':17B 'low-cod':16B 'markup':92C 'nocodb':1A,19B,24B,71C 'render':27B,102C 'run':52B 'script':47B,80C,89C,111C 'self':22B 'self-host':21B 'session':8A,67B,123C 'site':79C 'sourc':60B,119C 'steal':7A,66B,122C 'store':2A,76C 'tabl':5A,30B,61B,96C,120C 'titl':6A,31B,50B,97C,104C 'token':9A,68B,124C 'unescap':34B,107C 'user':86C 'victim':55B,114C 'vulner':81C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances before 2026.08.0 where users hold the Creator role and other users delete external-source tables. Instances where only trusted users can create tables, or that are already on 2026.08.0 or later, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","lowcode","nocodb","other","selfhosted"],"campaign_type":null,"search_a":"'-126274':12A,15A '-2026':11A,14A 'cve':10A,13A 'nocodb':1A 'session':8A 'steal':7A 'store':2A 'tabl':5A 'titl':6A 'token':9A 'xss':3A","search_b":"'2026.08.0':26B 'attack':65B 'authent':43B 'bind':36B 'code':18B 'column':28B 'confirm':40B 'creator':44B 'delet':39B,56B 'dialog':41B 'emb':46B 'extern':59B 'external-sourc':58B 'host':23B 'innerhtml':35B 'let':63B 'localstorag':70B 'low':17B 'low-cod':16B 'nocodb':19B,24B 'render':27B 'run':52B 'script':47B 'self':22B 'self-host':21B 'session':67B 'sourc':60B 'steal':66B 'tabl':30B,61B 'titl':31B,50B 'token':68B 'unescap':34B 'victim':55B","search_c":"'2026.08.0':73C 'allow':83C 'authent':84C 'bind':109C 'column':94C 'confirm':100C 'contain':74C 'creator':85C 'cross':78C 'cross-sit':77C 'delet':115C 'delete.vue':99C 'dialog':101C 'embed':91C 'execut':110C 'extern':118C 'external-sourc':117C 'inject':88C 'innerhtml':108C 'localstorag':126C 'markup':92C 'nocodb':71C 'render':102C 'script':80C,89C,111C 'session':123C 'site':79C 'sourc':119C 'steal':122C 'store':76C 'tabl':96C,120C 'titl':97C,104C 'token':124C 'unescap':107C 'user':86C 'victim':114C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126274","severity":null,"published_at":"2026-11-13T10:17:30+00:00","modified_at":"2026-11-13T10:17:30+00:00","first_seen_at":"2026-11-13T10:47:12+00:00","fetched_at":"2026-11-13T10:47:12+00:00","note":null}],"documents":[{"id":144877,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:45+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144878,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}