---
id: "CVE-2026-126274"
page: "https://infrastack.ai/live/CVE-2026-126274"
kind: "vulnerability"
aliases: ["CVE-2026-126274"]
title: "NocoDB: stored XSS in table titles steals session tokens"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["low-code", "nocodb", "other", "self-hosted"]
not_affected_if: ["creator-role-restricted", "version-2026.08.0-or-later"]
published_at: "2026-11-13T10:17:30+00:00"
first_seen_at: "2026-11-13T10:47:12+00:00"
updated_at: "2026-11-13T10:48:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126274", "first_seen_at": "2026-11-13T10:47:12+00:00"}]
exploit_sources: []
---

# NocoDB: stored XSS in table titles steals session tokens

Link for people: https://infrastack.ai/live/CVE-2026-126274 (this .md is for agents)

NocoDB before 2026.08.0 renders column and table titles through an unescaped innerHTML binding in its delete confirmation dialog. An authenticated Creator can embed script in a title, which runs when a victim deletes an external-source table and lets the attacker steal session tokens from localStorage.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the NocoDB version in use; versions before `2026.08.0` are in the affected range.
- Review who holds the Creator role, since they can set table and column titles.

## Fix

- NocoDB: move to `2026.08.0` or later.

## Timeline

- 2026-11-13T10:47:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126274

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog

## From the sources

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_