NocoDB up to 0.300.x SVG File Parser cross site scripting

Summaryinfo

A vulnerability was found in NocoDB up to 0.300.x. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component SVG File Parser. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-24769. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in NocoDB up to 0.300.x. This issue affects an unknown function of the component SVG File Parser. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-24769 since 01/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 0.301.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-4868). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• NocoDB

Version

• 0.300

Website

• Product: https://github.com/nocodb/nocodb/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion