Executive brief
NocoDB is an open-source database management platform that allows users to upload and preview file attachments. Authenticated users can upload malicious SVG files with embedded JavaScript code that executes in other users' browsers when they view the attachment. Attackers can exploit this to steal session tokens, hijack accounts, perform unauthorized actions, or escalate privileges if administrators view the malicious file.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in NocoDB's attachment handling mechanism. The root cause combines overly permissive MIME type checking (substring-based detection of "image/svg+xml") with unsafe inline file serving. SVG files are classified as previewable images but can contain executable JavaScript via script elements and event handlers. The fileReadv3 endpoint serves uploaded SVG attachments with Content-Type: image/svg+xml and Content-Disposition: inline without sanitization, causing browsers to execute embedded JavaScript under the application's origin. Attack requires authentication and file upload permissions, but victims (any user viewing the attachment) do not need to take action beyond viewing. The fix is available in version 0.301.0 and later.
Affected products
- NocoDB NocoDB < 0.301.0
Timeline
- 2026-01-28: disclosed: GHSA-q5c6-h22r-qpwr and CVE-2026-24769 published
- 2026-01-28: patched: Fix released in version 0.301.0