Act nowDisclosed

Advisory · CVE-2026-126269

NocoDB stored XSS in data cell comments runs scripts for viewers

NocoDB before 0.288.2 has a stored cross-site scripting flaw that lets authenticated attackers inject arbitrary JavaScript via data cell comments. The comment feature in cell fields embeds malicious script that executes in the browser of users viewing the comment; fixed in 0.288.2.

Advisory published November 13, 2026Independent summary
Vendor
NocoDB
Product
NocoDB
Identifier / CWE
CVE-2026-126269
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

NocoDB lets people comment on table cells. A comment can carry a script, and the script runs for anyone who views it, letting the attacker act as that person.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Comment injected

    An authenticated attacker injects JavaScript into a data cell comment.

  2. 02Script stored

    The comment is stored with the script intact.

  3. 03Viewer opens cell

    Another user views the comment in their browser.

  4. 04Script executes

    The script runs with the viewer's session, enabling account takeover or data theft.

What happened

NocoDB before 0.288.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript via data cell comments. Attackers can use the comment feature in cell fields to embed malicious script that executes in the browser of users viewing the comment. The record rates it critical at CVSS 9.3 under version 4.0.

What to do

  1. Upgrade NocoDB to 0.288.2 or later.
  2. Review recent cell comments for injected script content.
  3. Check for unusual sessions or actions by users who viewed affected records.
  4. Rotate credentials for accounts that may have been hijacked.
  5. Confirm the patched version is running.

Management note

Stored XSS in a shared workspace tool spreads through normal use: every viewer is a victim. Patch, then check the comment history.