CVE-2026-53929
NocoDB: Stored Cross-Site Scripting via Secure Attachment
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACHMENTS=true, an authenticated uploader could deliver .html or .svg attachments that the browser rendered inline from the NocoDB origin instead of forcing a download. The signed attachment handler stored response-header overrides under PascalCase keys (ResponseContentDisposition, ResponseContentType) while the controller that served the file read them under lowercase-hyphen names (response-content-disposition). The mismatch dropped the Content-Disposition: attachment header, leaving Express to auto-render .html, .svg, and similar inline. This vulnerability is fixed in 2026.05.1.
| CWE | CWE-79 |
| Vendor | nocodb |
| Product | nocodb |
| Published | Jun 23, 2026 |
Get instant alerts for nocodb nocodb
Be the first to know when new unknown vulnerabilities affecting nocodb nocodb are published — delivered to Slack, Telegram or Discord.