{"id":"CVE-2026-126279","kind":"vulnerability","aliases":["CVE-2026-126279"],"related":[],"title":"NocoDB: stored XSS in AI field prompts steals session tokens","description":"NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim.","summary":"NocoDB before 2026.06.2 renders unescaped field references from AI field prompts as HTML in a tooltip. A user with Creator role or above can store script that runs when another user opens the field configuration, letting an attacker read the localStorage session token and call authenticated APIs as the victim.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"NocoDB","fixed":[],"affected":"","ecosystem":"vendor"},{"via":"cpe","name":"nocodb","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm","vendor"],"tags":["ai-fields","ai-tooling","nocodb","self-hosted"],"not_affected_if":["no-creator-role-users","nocodb-2026.06.2-or-later"],"how_to_check":"- Check the NocoDB version in use; affected builds are those before `2026.06.2`.\n- Look for AI field prompts that reference other fields, created by Creator-role users you do not fully trust.","fix":"- NocoDB: upgrade to `2026.06.2` or later.","status":"open","published_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","triaged_at":"2026-11-13T10:54:30+00:00","updated_at":"2026-11-13T11:20:09+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:54:30Z","model":"claude-haiku-5-5","output":{"fix":"- NocoDB: upgrade to `2026.06.2` or later.","reach":"network","title":"NocoDB: stored XSS in AI field prompts steals session tokens","impact":"high","summary":"NocoDB before 2026.06.2 renders unescaped field references from AI field prompts as HTML in a tooltip. A user with Creator role or above can store script that runs when another user opens the field configuration, letting an attacker read the localStorage session token and call authenticated APIs as the victim.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["nocodb","self-hosted","ai-fields"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads session tokens and acts as the victim in NocoDB","analyst_note":"","how_to_check":"- Check the NocoDB version in use; affected builds are those before `2026.06.2`.\n- Look for AI field prompts that reference other fields, created by Creator-role users you do not fully trust.","plain_action":"","product_name":"NocoDB","needs_analyst":false,"not_affected_if":["nocodb-2026.06.2-or-later","no-creator-role-users"],"who_is_affected":"Self-hosted or managed NocoDB instances before 2026.06.2 where users with Creator role or above can edit AI field prompts. Exposure depends on who can create or edit AI fields and on other users opening those field configurations. Instances with only trusted editors still carry the stored-XSS risk if an account is compromised.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4631,"output_tokens":582,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126279':13A,16A '-2026':12A,15A '2026.06.2':31B,81C 'ai':5A,20B,23B,37B,98C 'ai-field':19B 'ai-tool':22B 'anoth':58B 'api':75B,138C 'attack':66B,106C 'authent':74B,137C 'call':73B,136C 'configur':63B,129C 'contain':82C 'creator':48B,109C 'cross':86C 'cross-sit':85C 'cve':11A,14A 'execut':123C 'field':6A,21B,34B,38B,62B,95C,99C,120C,128C 'host':28B 'html':41B,102C 'let':64B 'localstorag':69B,132C 'markup':115C 'nocodb':1A,17A,18A,25B,29B,79C 'open':60B,126C 'prompt':7A,39B,100C,118C 'promptwithfields.vue':91C 'read':67B 'refer':35B,96C,121C 'render':32B,93C 'role':49B,110C 'run':56B 'script':54B,88C 'self':27B 'self-host':26B 'session':9A,70B,133C 'site':87C 'steal':8A,130C 'store':2A,53B,84C,114C 'token':10A,71B,134C 'tool':24B 'tooltip':44B,105C 'unescap':33B,94C 'user':46B,59B 'victim':78B,125C,141C 'vulner':89C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NocoDB instances before 2026.06.2 where users with Creator role or above can edit AI field prompts. Exposure depends on who can create or edit AI fields and on other users opening those field configurations. Instances with only trusted editors still carry the stored-XSS risk if an account is compromised.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nocodb"],"ptokens":["nocodb"],"labels":["aifields","aitooling","high","nocodb","npm","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126279':13A,16A '-2026':12A,15A 'ai':5A 'cve':11A,14A 'field':6A 'nocodb':1A,17A,18A 'prompt':7A 'session':9A 'steal':8A 'store':2A 'token':10A 'xss':3A","search_b":"'2026.06.2':31B 'ai':20B,23B,37B 'ai-field':19B 'ai-tool':22B 'anoth':58B 'api':75B 'attack':66B 'authent':74B 'call':73B 'configur':63B 'creator':48B 'field':21B,34B,38B,62B 'host':28B 'html':41B 'let':64B 'localstorag':69B 'nocodb':25B,29B 'open':60B 'prompt':39B 'read':67B 'refer':35B 'render':32B 'role':49B 'run':56B 'script':54B 'self':27B 'self-host':26B 'session':70B 'store':53B 'token':71B 'tool':24B 'tooltip':44B 'unescap':33B 'user':46B,59B 'victim':78B","search_c":"'2026.06.2':81C 'ai':98C 'api':138C 'attack':106C 'authent':137C 'call':136C 'configur':129C 'contain':82C 'creator':109C 'cross':86C 'cross-sit':85C 'execut':123C 'field':95C,99C,120C,128C 'html':102C 'localstorag':132C 'markup':115C 'nocodb':79C 'open':126C 'prompt':100C,118C 'promptwithfields.vue':91C 'refer':96C,121C 'render':93C 'role':110C 'script':88C 'session':133C 'site':87C 'steal':130C 'store':84C,114C 'token':134C 'tooltip':105C 'unescap':94C 'victim':125C,141C 'vulner':89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T10:06:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126279","severity":null,"published_at":"2026-11-13T10:17:31+00:00","modified_at":"2026-11-13T10:17:31+00:00","first_seen_at":"2026-11-13T10:47:13+00:00","fetched_at":"2026-11-13T10:47:13+00:00","note":null}],"documents":[{"id":144887,"url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-j96w-qm45-vgp2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T10:06:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144888,"url":"https://www.vulncheck.com/advisories/nocodb-before-2026.06.2-stored-xss-via-ai-field-prompt-tooltip","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}