Description
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.
References
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.