CVE-2026-126269

NocoDB stored XSS in attachment MIME type handling

critical · 9.3

Fix listed

NocoDB

Published Nov 13, 2026, 09:36 UTC

Description

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims.

Reported fixed versions

2026.09.0

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.