Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2026-126274 EUVD-2026-125247GHSA-q33x-f753-x487

NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog

Published Nov 13, 2026 · Updated Nov 13, 2026 · Assigned by VulnCheck

Vendor: nocodb Product: nocodb

Description

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

Affected products

VendorProductAffectedFixed
nocodb nocodb < 2026.08.0 2026.08.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • googlesky/CVE-2026-126274 ★ 0 · Nov 14, 2026

    CVE-2026-126274 PoC: NocoDB's table-deletion dialog renders Creator-authored table/column titles through an unescaped innerHTML binding, executing markup when a victim confirms deleting a linked tabl…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References