Cross-site scripting in NocoDB - CVE-2026-126274
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162888
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-126274
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to execute script in a victim's browser, steal their session token, and access their data.
The vulnerability exists due to unescaped column and table titles rendered as HTML in NocoDB's deletion dialog for external data source tables with incoming link columns. An authenticated attacker with the base Creator role can store malicious titles that execute when a victim with the base Creator role or above confirms deletion of the referenced table.
Affected software
NocoDB
How to mitigate CVE-2026-126274
Install security update from vendor's website.
NocoDB - update to 2026.08.0