CVE-2026-53929 Overview
CVE-2026-53929 is a stored cross-site scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw affects deployments running with NC_SECURE_ATTACHMENTS=true prior to version 2026.05.1. An authenticated user with upload privileges can deliver .html or .svg attachments that the browser renders inline from the NocoDB origin rather than forcing a download. The vulnerability is tracked under [CWE-79] and resolved in NocoDB 2026.05.1.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in the NocoDB origin context by uploading crafted .html or .svg attachments, enabling session theft and actions against other users.
Affected Products
- NocoDB versions prior to 2026.05.1
- Deployments configured with NC_SECURE_ATTACHMENTS=true
- Self-hosted NocoDB instances serving signed attachments via the affected controller
Discovery Timeline
- 2026-06-23 - CVE-2026-53929 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53929
Vulnerability Analysis
The vulnerability stems from a case-sensitivity mismatch between two components of the NocoDB signed attachment pipeline. The signed attachment handler stored response-header overrides under PascalCase keys such as ResponseContentDisposition and ResponseContentType. The controller that ultimately served the file read those overrides under lowercase-hyphen names such as response-content-disposition.
Because the keys never matched, the Content-Disposition: attachment header was silently dropped from outbound responses. Express then fell back to its default behavior and rendered .html, .svg, and similar content inline. Any embedded script executes in the NocoDB origin, giving the attacker access to cookies, tokens, and the authenticated session of the victim. Exploitation requires authentication and user interaction to open the attachment link, but the attack vector is network-based.
Root Cause
The root cause is a key-naming contract violation between the signed URL generator and the file-serving controller. The handler that produced signed URLs serialized response overrides using PascalCase identifiers, while the consumer expected AWS-style lowercase-hyphen query parameters. The mismatch effectively disabled the Content-Disposition override and any other header overrides that should have forced safe download behavior.
Attack Vector
An authenticated user with attachment upload permission stores a malicious .html or .svg file in a NocoDB table. The attacker then shares the signed attachment link, or relies on another user opening the record. When the victim follows the link, the NocoDB server returns the attachment without Content-Disposition: attachment, and the browser renders the file inline. JavaScript inside the file executes in the NocoDB origin, allowing the attacker to read session storage, call NocoDB APIs as the victim, and pivot to other users or workspaces.
No verified public proof-of-concept code is available. For technical details, refer to the NocoDB GitHub Security Advisory GHSA-6mhr-74x2-98v9.
Detection Methods for CVE-2026-53929
Indicators of Compromise
- Attachment uploads with .html, .htm, .svg, .xhtml, or .xml extensions in NocoDB storage
- HTTP responses from the NocoDB attachment endpoint missing the Content-Disposition: attachment header for user-uploaded files
- Signed attachment URLs containing PascalCase parameters like ResponseContentDisposition or ResponseContentType
- Unexpected outbound requests from browsers immediately after a user opens a NocoDB attachment link
Detection Strategies
- Inspect web server access logs for GET requests to the attachment endpoint returning text/html or image/svg+xml content types
- Audit attachment metadata in the NocoDB database for files with script-capable MIME types or extensions uploaded by non-administrative accounts
- Replay signed attachment URLs in a controlled environment and verify that responses include Content-Disposition: attachment
Monitoring Recommendations
- Alert on new .html or .svg uploads to NocoDB workspaces, particularly from recently created or low-privilege accounts
- Monitor browser-side errors and Content Security Policy reports originating from the NocoDB domain
- Track API calls made from session tokens immediately after attachment access to identify session abuse
How to Mitigate CVE-2026-53929
Immediate Actions Required
- Upgrade NocoDB to version 2026.05.1 or later, where the header key mismatch is corrected
- Audit existing attachments for .html, .svg, and similar script-capable files and remove untrusted entries
- Restrict attachment upload permissions to trusted users until the upgrade is complete
Patch Information
The vulnerability is fixed in NocoDB 2026.05.1. The patch aligns the response-header override keys so the Content-Disposition: attachment header is consistently emitted by the signed attachment controller. Review the NocoDB GitHub Security Advisory GHSA-6mhr-74x2-98v9 for upgrade guidance.
Workarounds
- Place a reverse proxy in front of NocoDB that forces Content-Disposition: attachment for responses serving user-uploaded files
- Block or strip .html, .htm, .svg, .xhtml, and similar extensions at the upload layer until patching is complete
- Serve attachments from a separate sandbox domain to isolate any inline-rendered content from the NocoDB session origin
- Enforce a strict Content Security Policy on the NocoDB origin to limit script execution from inline-rendered attachments
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
