Cross-site scripting in NocoDB - CVE-2026-126279
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU162897
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-126279
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with the Creator role or above to execute scripts in another user's browser and make authenticated API calls with that user's permissions.
The vulnerability exists due to unsanitized field references in NocoDB AI field prompts being rendered as HTML in configuration tooltips. An authenticated attacker with the Creator role or above can store a malicious prompt that executes when a victim opens the affected field's configuration.
Affected software
NocoDB
How to mitigate CVE-2026-126279
Install security update from vendor's website.
NocoDB - update to 2026.06.2