CVE-2026-24769

A stored Cross-site Scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment.

Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.

Vulnerability Details

NocoDB allows file attachments to be previewed inline based on their MIME type. Due to overly permissive MIME type checks and a lack of content sanitization, SVG files containing executable JavaScript are incorrectly treated as safe image content and rendered directly in the browser.

Root Cause

The vulnerability results from a combination of overly permissive MIME type classification and unsafe file serving behavior.

1. Permissive MIME Type Check

In attachmentHelpers.ts, files are considered previewable if their MIME type contains certain substrings:

const previewableMimeTypes = ['image', 'pdf', 'video', 'audio'];

export const isPreviewAllowed = (args: { mimetype?: string } = {}) => {
  const { mimetype } = args;
  if (!mimetype) return false;
  return previewableMimeTypes.some((type) => mimetype.includes(type));
};

This substring-based check (includes) causes files with the MIME type image/svg+xml to be classified as safe for inline preview. However, SVG is an XML-based format that supports executable JavaScript via <script> elements, event handlers, and external references.

No additional validation or sanitization is performed on SVG content after this classification.

2. Unsafe Inline File Serving

Uploaded attachments are served by the fileReadv3 endpoint in attachments.controller.ts without sanitization or content-type enforcement:

@Get('/dltemp/:param(*)')
async fileReadv3(@Param('param') param: string, @Res() res: Response) {
  // No authentication guard

  // Sets headers from query parameters
  res.setHeader('Content-Type', queryParams.contentType);
  res.setHeader('Content-Disposition', queryParams.contentDisposition);

  // Sends raw file content
  res.sendFile(file.path);
}

The endpoint:

• Preserves the original Content-Type (image/svg+xml)
• Uses Content-Disposition: inline
• Sends the raw file contents unmodified

As a result, browsers render the SVG inline and execute any embedded JavaScript under the NocoDB application’s origin.

Credit

This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter Stöckli) and @m-y-mo (Man Yue Mo).

This is a stored XSS vulnerability that can be exploited by authenticated users with permission to upload attachments.

Potential impacts include:

• Account takeover
• Theft of session cookies or API tokens
• Unauthorized actions performed on behalf of victims
• Privilege escalation if higher-privileged users view the malicious attachment

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Kodem intelligence

1. What is CVE-2026-24769? CVE-2026-24769 is a high-severity cross-site scripting (XSS) vulnerability in nocodb (npm), affecting versions < 0.301.0. It is fixed in 0.301.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. Which versions of nocodb are affected by CVE-2026-24769? nocodb (npm) versions < 0.301.0 is affected.
3. Is there a fix for CVE-2026-24769? Yes. CVE-2026-24769 is fixed in 0.301.0. Upgrade to this version or later.
4. Is CVE-2026-24769 exploitable, and should I be worried? Whether CVE-2026-24769 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-24769 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-24769? Upgrade nocodb to 0.301.0 or later.