CVE-2026-126274

CVSS 9.3 (critical) · published 2026-11-13

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

Weakness: CWE-79

Source: NVD CVE-2026-126274

References

• https://github.com/nocodb/nocodb/security/advisories/GHSA-638g-xw92-xq9x
• https://www.vulncheck.com/advisories/nocodb-before-2026.08.0-stored-xss-via-table-deletion-dialog

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.