Before 2026.08.0 Stored XSS via Table Deletion Dialog
Not on CISA's list of exploited flaws, and not in the news we track.
0.37%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126274. Nothing runs until you send it.
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.
You are affected if
The fix