CVE-2026-24769: NocoDB Stored XSS Vulnerability via SVG Upload
Summary
CVE-2026-24769: NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload. Affects nocodb versions < 0.301.0. Fixed in 0.301.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source no-code platform that allows users to create applications and manage databases without writing code. It enables users to upload various file types, including images, PDFs, and videos, for attachment handling. However, due to a flaw in its attachment handling mechanism, NocoDB is vulnerable to stored Cross-Site Scripting (XSS) attacks, specifically through the upload of SVG files containing malicious scripts.
Vulnerability Detail
The vulnerability arises from overly permissive MIME type checks and unsafe file serving behavior in NocoDB. Authenticated users can upload SVG files that contain embedded JavaScript. These files are stored on the server and later rendered inline in the browsers of other users, executing the malicious scripts. This can lead to severe consequences, including account compromise, data exfiltration, and unauthorized actions performed on behalf of affected users. The root cause is a combination of permissive MIME type classification and a lack of content sanitization during file serving.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.301.0
This is the first release that contains the fix.
npm install nocodb@0.301.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the upload of SVG files by modifying the MIME type checks in the code. You can adjust the 'isPreviewAllowed' function in 'attachmentHelpers.ts' to exclude 'image/svg+xml' from the allowed MIME types. Here is an example of how to modify the code:
const previewableMimeTypes = ['image', 'pdf', 'video', 'audio'];
export const isPreviewAllowed = (args: { mimetype?: string } = {}) => {
const { mimetype } = args;
if (!mimetype) return false;
return previewableMimeTypes.some((type) => mimetype.includes(type)) && mimetype !== 'image/svg+xml';
};
Conclusion
The stored XSS vulnerability in NocoDB allows authenticated users to upload malicious SVG files that can compromise other users' accounts and data. It is crucial to update to the patched version or implement the suggested workarounds to mitigate the risk.
See every vulnerability recorded for nocodb →
FAQ
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
Authenticated users with permission to upload attachments can exploit this vulnerability.
Potential impacts include account takeover, theft of session cookies or API tokens, and unauthorized actions performed on behalf of victims.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
Vulert is a monitoring tool that uses package-lock.json to alert in real-time for open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
