XSS in Nocodb

CVE-2026-53929

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authenticated uploader could deliver .html or .svg attachments that the browser rendered inline from the NocoDB origin inste…

Vulnerability class: XSS (Cross-Site Scripting)

Affected products

  • Nocodb — versions < 2026.05.1

Weakness classification (CWE)

References