CVE-2026-24769: NocoDB Stored XSS via SVG Attachments
NocoDB versions prior to 0.301.0 contain a stored cross-site scripting issue in attachment handling, where SVG files uploaded by authenticated users can run JavaScript in other users' browsers. The record rates it critical, with CVSS 3.1 score 9 from NVD and CVSS 4.0 score 8.5 from GitHub, and states that version 0.301.0 fixes it. No confirmed active exploitation appears in the sources consulted.
Overview
NocoDB is software for building databases in a spreadsheet-like interface. According to the record, versions prior to 0.301.0 contain a stored cross-site scripting issue in attachment handling, classified as CWE-79. The record states that version 0.301.0 patches the issue.
Impact
Authenticated users can upload SVG files with embedded JavaScript. The script can run in the browser of any other user who views the attachment, under the application origin. The record states that this can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.
Affected products and versions
- Product: Nocodb Nocodb
- Affected range: versions prior to 0.301.0
- Fixed in: 0.301.0, according to the record description. The structured fixes field in the record is empty.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, so no active exploitation is reported in the sources consulted. The GitHub reference is tagged Exploit in the record, but the record does not describe its content, and that tag does not confirm exploitation in the wild.
Remediation and mitigation
- Upgrade NocoDB to version 0.301.0 or later, as described in the GitHub security advisory.
- Until the upgrade is applied, limit which accounts can upload attachments and review existing SVG attachments.
- Do not render user-uploaded SVG files inline. Serve attachments as downloads with restrictive content types and security headers.
Detection guidance
- Inventory stored attachments and identify SVG files, especially those uploaded by low-privilege or recently created accounts.
- Review application logs for unusual attachment uploads and for access to attachments by many users.
- Check whether attachments are rendered inline in the browser and whether a restrictive content security policy is in place.
Limitations of the available information
The record does not give a list of affected builds beyond the version range, does not include EPSS or SSVC data, and does not include the full advisory text. The CVSS 3.1 score comes from NVD and the CVSS 4.0 score from GitHub; the record gives no further scoring rationale.
Frequently asked questions
Which NocoDB versions are affected?
The record lists versions prior to 0.301.0 as affected. Version 0.301.0 is stated to patch the issue.
How can the vulnerability be exploited?
The record says an authenticated user can upload SVG files containing embedded JavaScript, which runs when other users view the attachment. Details of exploitation steps are not provided here.
Is there evidence of active exploitation?
The record shows no KEV listing, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.