CVE-2026-53929

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1

Description When NC SECURE ATTACHMENTS is set to true, an authenticated uploader can upload .html or .svg attachments that the browser renders inline from the NocoDB origin instead of forcing a download. This occurs because the signed attachment handler stores response-header overrides using PascalCase keys (ResponseContentDisposition, ResponseContentType), whereas the controller serving the file expects lowercase-hyphen names (response-content-disposition). This mismatch causes the Content-Disposition: attachment header to be dropped, allowing Express to auto-render these files inline. This leads to Stored Cross-Site Scripting (XSS), where a script executing in a victim's browser can read the authentication JWT from localStorage.

Recommendations Update to version 2026.05.1.