PT-2026-50475 · Nocodb · Nocodb
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
NocoDB versions prior to 2026.05.1
Description
When
NC SECURE ATTACHMENTS is set to true, an authenticated uploader can upload .html or .svg attachments that the browser renders inline from the NocoDB origin instead of forcing a download. This occurs because the signed attachment handler stores response-header overrides using PascalCase keys (ResponseContentDisposition, ResponseContentType), whereas the controller serving the file expects lowercase-hyphen names (response-content-disposition). This mismatch causes the Content-Disposition: attachment header to be dropped, allowing Express to auto-render these files inline. This leads to Stored Cross-Site Scripting (XSS), where a script executing in a victim's browser can read the authentication JWT from localStorage.Recommendations
Update to version 2026.05.1.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nocodb