Description
Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| teableio | teable | < 2026-10-12T12-45-53Z.3331 | 2026-10-12T12-45-53Z.3331 |
References
- GitHub Security Advisory (GHSA-2fm5-fcfx-hq5f) vendor-advisory
- https://github.com/teableio/teable/commit/3c1c4646bfddfb14b1f2fbab8d0e1189969fa304 patch
- Teable release.2026-10-12T12-45-53Z.3331 Release Notes release-notes
- https://github.com/teableio/teable/blob/5ef2238883cad7c3980084de9a9031135fb9734f/apps/nestjs-backend/src/features/attachments/attachments.controller.ts#L52-L71 technical-description
- VulnCheck Advisory: Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads third-party-advisory