SB20261109121 - Cross-site scripting in NocoDB

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109121

SB20261109121 - Cross-site scripting in NocoDB

Published: November 9, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261109121
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-126279)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker with the Creator role or above to execute scripts in another user's browser and make authenticated API calls with that user's permissions.

The vulnerability exists due to unsanitized field references in NocoDB AI field prompts being rendered as HTML in configuration tooltips. An authenticated attacker with the Creator role or above can store a malicious prompt that executes when a victim opens the affected field's configuration.


Remediation

Install update from vendor's website.

References