CVE-2026-24769: NocoDB Stored XSS Vulnerability

CVE-2026-24769 Overview

CVE-2026-24769 is a stored cross-site scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The vulnerability exists in NocoDB's attachment handling mechanism, where authenticated users can upload malicious SVG files containing embedded JavaScript. When other users view these attachments, the malicious scripts are rendered inline and executed in their browsers under the application's origin context.

Critical Impact

Successful exploitation enables account compromise, data exfiltration, and unauthorized actions performed on behalf of affected users through persistent client-side script injection.

Affected Products

• NocoDB versions prior to 0.301.0

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-24769 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24769

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) stems from improper neutralization of input during web page generation. The vulnerability allows authenticated attackers to persistently inject malicious client-side scripts into the application by exploiting the SVG file upload functionality. Unlike reflected XSS attacks that require victim interaction with a malicious link, stored XSS payloads are persisted server-side and automatically executed whenever a victim views the compromised content.

The attack is particularly dangerous because SVG files are XML-based vector images that can legitimately contain embedded JavaScript through elements like <script> tags or event handlers such as onload. When NocoDB renders these SVG attachments inline without proper sanitization, the embedded JavaScript executes within the application's security context, giving the attacker access to session cookies, authentication tokens, and the ability to perform actions as the victim user.

Root Cause

The root cause is insufficient input validation and output encoding in NocoDB's attachment handling system. The application fails to properly sanitize SVG file content before storing and subsequently rendering attachments. Specifically, the application does not strip or neutralize JavaScript code embedded within SVG files, and it renders SVG content inline rather than serving it with appropriate Content-Type headers or Content Security Policy restrictions that would prevent script execution.

Attack Vector

The attack is network-based and requires low privileges (an authenticated account) to execute. The attacker uploads a crafted SVG file containing malicious JavaScript as an attachment within NocoDB. When other authenticated users access the record containing the malicious attachment, the SVG is rendered in their browser, executing the embedded JavaScript code. This allows the attacker to steal session tokens, perform CSRF attacks, modify data, or redirect users to phishing pages—all without the victim's knowledge.

The attack payload is typically embedded within SVG elements that support scripting, such as inline <script> tags, onload event handlers on <svg> root elements, or href attributes using javascript: URIs on <a> elements within the SVG.

Detection Methods for CVE-2026-24769

Indicators of Compromise

• SVG file uploads containing <script> tags, javascript: URIs, or event handler attributes like onload, onerror, or onclick
• Unusual JavaScript execution patterns originating from attachment rendering contexts
• Unexpected network requests to external domains initiated from the NocoDB application
• User reports of unexpected behavior after viewing attachments

Detection Strategies

• Implement Content Security Policy (CSP) headers to restrict inline script execution and monitor for CSP violation reports
• Enable Web Application Firewall (WAF) rules to detect and block SVG files containing script elements
• Monitor application logs for SVG file uploads and correlate with subsequent suspicious activity
• Deploy browser-based XSS auditing and detection mechanisms

Monitoring Recommendations

• Log and review all file upload activities, particularly SVG and other XML-based file types
• Monitor for anomalous session behavior following attachment views, such as rapid data access or configuration changes
• Track CSP violation reports for evidence of blocked XSS attempts
• Review outbound network traffic for data exfiltration patterns

How to Mitigate CVE-2026-24769

Immediate Actions Required

• Upgrade NocoDB to version 0.301.0 or later immediately
• Audit existing SVG attachments for malicious content and remove any suspicious files
• Implement Content Security Policy headers that restrict inline script execution
• Consider temporarily disabling SVG file uploads until the patch is applied

Patch Information

The vulnerability has been addressed in NocoDB version 0.301.0. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Configure the web server to serve SVG files with Content-Type: image/svg+xml and Content-Disposition: attachment headers to force download instead of inline rendering
• Implement a strict Content Security Policy that blocks inline scripts: script-src 'self'
• Use a Web Application Firewall to filter SVG uploads containing script elements
• Restrict SVG uploads entirely at the application or reverse proxy level until patching is complete

# Example nginx configuration to force SVG downloads
location ~* \.svg$ {
    add_header Content-Disposition "attachment";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "script-src 'none'";
}