CVE-2026-126279

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.06.2

Description A stored cross-site scripting issue exists in the PromptWithFields.vue component. The application renders unescaped field references from AI field prompts as HTML within a tooltip. Users with the Creator role or higher can inject malicious markup into a prompt's field reference. This markup executes when another user opens the field configuration, allowing the attacker to steal the localStorage session token and perform authenticated API calls on behalf of the victim.

Recommendations Update NocoDB to version 2026.06.2 or later.