Stored XSS in NocoDB via Unescaped Table Titles

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in NocoDB versions before 2026.08.0. Authenticated Creator users can inject malicious scripts by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles unsafely using innerHTML, allowing script execution when a victim deletes an external-source table. The injected script can steal session tokens from localStorage.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect NocoDB instances for versions before 2026.08.0. Check for malicious scripts in column or table titles, particularly in Delete.vue confirmation dialogs. Review server logs for unusual deletion actions or unauthorized localStorage access.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Creator access could steal your session tokens, enabling them to impersonate you and perform authenticated actions. They could also exfiltrate data accessible to your account. The attack requires user interaction (confirming table deletion) but can be triggered by any user with sufficient privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.08.0 or later immediately. Remove any suspicious column or table titles containing scripts. Restrict Creator role permissions to prevent unauthorized payload creation. Monitor for unauthorized session token access or data exfiltration.

Useful 0 Not Useful 0