Permissive List of Allowed Inputs in NocoDB - #VU162859
Published: November 9, 2026
Vulnerability identifier: #VU162859
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-183
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to capture passwords entered into spoofed sign-in forms within NocoDB.
The vulnerability exists due to permissive HTML sanitization in the rich text cell renderer that retains forms and styling when displaying stored content. An authenticated attacker can edit records in a table containing a rich text field to store a page-sized form overlay that sends passwords to an external address when viewers submit them.
Affected software
NocoDB
Remediation
Install security update from vendor's website.
NocoDB - update to 2026.10.1