Mouhebbenelwafi

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.05.1 **Description** An authenticated commenter can store HTML in row comments that executes as a script when other users hover over the comment in the expanded form view. This occurs because comment write paths persist the raw comment body without server-side sanitization. The expanded-form sidebar renders the stored body and passes its `data-tooltip` attribute to Tippy with `allowHTML: true`. Consequently, attribute-level payloads re-enter the Document Object Model (DOM)—the programming interface for HTML and XML documents—as live HTML on hover, even if script tags were stripped during the initial write. This allows for Stored Cross-Site Scripting (XSS), where a script runs in the NocoDB origin using the victim's session, potentially allowing the reading of the authentication JSON Web Token (JWT) from `localStorage`. **Recommendations** Update to version 2026.05.1.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.05.1 **Description** An authenticated user with base-create permission can attach a SQLite source pointing to an arbitrary file on the host, including internal databases. The SQLite client and the base/integration create services accept a caller-supplied filename and pass it to the `fs.exists` and `fs.open('w')` functions without restricting the location. This allows a user to point a source at `noco.db`, a tenant database under `nc minimal dbs/`, or any writable path accessible to the NocoDB process, enabling the reading or overwriting of contents through regular table APIs. This can lead to the disclosure and modification of internal state, other tenants' databases, and any file the process can access. **Recommendations** Update to version 2026.05.1.