# CVE-2026-53929: NocoDB stored cross-site scripting in secure attachments

Source: https://junglewise.ai/threats/cve-2026-53929-nocodb-stored-cross-site-scripting-in-secure-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-53929 · Severity: medium · CVSS 4 · Published 2026-06-23

NocoDB, a platform that turns databases into smart spreadsheets, is vulnerable to a security flaw when handling file attachments. An authorized user could upload malicious files (like HTML or SVG) that, when opened by another user, execute code within their browser. This could allow an attacker to steal login tokens or perform actions on behalf of other users, potentially compromising sensitive data stored in the database.

Technologies: [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-53929 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53929 being exploited in the wild.

**How severe is CVE-2026-53929?** Medium severity, with a CVSS score of 4, published 23 June 2026.

**Which products and versions are affected?** nocodb (npm) <= 0.301.3, SEMVER:introduced=0,last_affected=0.301.3.

**Is there a fix for CVE-2026-53929?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53929 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53929?** Check whether you run nocodb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in NocoDB prior to version 2026.05.1 when NC_SECURE_ATTACHMENTS is enabled. The vulnerability is caused by a case-sensitivity mismatch in response-header overrides: the signed attachment handler stores keys in PascalCase (e.g., ResponseContentDisposition), while the serving controller attempts to read them using lowercase-hyphenated names (e.g., response-content-disposition). This mismatch causes the 'Content-Disposition: attachment' header to be dropped, leading the Express framework to render .html and .svg files inline. An authenticated attacker can exploit this to execute arbitrary JavaScript in the context of the NocoDB origin and steal authentication JWTs from localStorage. The issue is fixed in version 2026.05.1 by correcting the key casing and enforcing strict MIME types for non-previewable files.

## Affected products

- nocodb nocodb < 2026.05.1

## Identifiers

- CVE-2026-53929
- GHSA-6mhr-74x2-98v9

## Timeline

- 2026-06-13: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD

## References

- [https://github.com/nocodb/nocodb/security/advisories/GHSA-6mhr-74x2-98v9](https://github.com/nocodb/nocodb/security/advisories/GHSA-6mhr-74x2-98v9)

## Related threats

- [NocoDB SSRF in spreadsheet-import endpoint](https://junglewise.ai/threats/cve-2026-53931-nocodb-ssrf-in-spreadsheet-import-endpoint)
- [NocoDB SSRF in base-migration endpoint](https://junglewise.ai/threats/cve-2026-53930-nocodb-ssrf-in-base-migration-endpoint)
- [NocoDB insufficient session expiration in password recovery flow](https://junglewise.ai/threats/cve-2026-53928-nocodb-insufficient-session-expiration-in-password-recovery-flow)
- [NocoDB SSRF in spreadsheet-fetch endpoint](https://junglewise.ai/threats/cve-2026-53927-nocodb-ssrf-in-spreadsheet-fetch-endpoint)
- [NocoDB insufficient session expiration in OAuth token revocation](https://junglewise.ai/threats/cve-2026-53926-nocodb-insufficient-session-expiration-in-oauth-token-revocation)