CVE-2026-53929 NocoDB: Stored Cross-Site Scripting via Secure Attachment
Authenticated users can execute arbitrary scripts via malicious HTML or SVG attachments when secure attachments are enabled, due to header key mismatches.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-53929?
CVE-2026-53929 is a medium-severity cross-site scripting vulnerability in nocodb, published on 23 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authenticated uploader could deliver .html or .svg attachments that the browser rendered inline from the NocoDB origin instead of forcing a download. The signed attachment handler stored response-header overrides under PascalCase keys (ResponseContentDisposition, ResponseContentType) while the controller that served the file read them under lowercase-hyphen names (response-content-disposition). The mismatch dropped the Content-Disposition: attachment header, leaving Express to auto-render .html, .svg, and similar inline. This vulnerability is fixed in 2026.05.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-53929?
2 open source packages ship an affected version, including nocodb.
| Package | Affected | Fixed in |
|---|---|---|
nocodb npm | All versions to 0.301.3 | None |
nocodb npm | All versions to 0.301.3 | None |
How do I fix CVE-2026-53929?
No fix has been published for CVE-2026-53929 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-53929 being exploited?
There is no known exploitation of CVE-2026-53929 in the wild and no public exploit code.
Sources
Also known as GHSA-6mhr-74x2-98v9.