Vulnerability · Published Jan 28, 2026 · Assigned by GitHub_M
CVE-2026-24769NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
High 8.5
In plain English
A high-severity cross-site scripting in nocodb from nocodb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | nocodb | 0.301.0 | GHSA-q5c6-h22r-qpwr |
Affected products (as reported)
Weakness: CWE-79, CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
References
- https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr x_refsource_CONFIRM