CVE-2026-24769 is a critical (CVSS 9.0) stored cross-site scripting flaw in NocoDB. An authenticated user can upload an SVG file with embedded script that runs in other users' browsers when they view the attachment. Versions before 0.301.0 are affected. Upgrade to 0.301.0.
What's affected
The record says NocoDB prior to 0.301.0 is affected, and 0.301.0 patches it. The GitHub advisory's metadata box also shows a different affected range, so confirm the exact range on the advisory page, but the fixed version is 0.301.0.
NocoDB previews attachments inline based on their MIME type. The advisory says overly permissive type checks and no content sanitizing let SVG files that contain executable script be treated as safe images and rendered directly. Because the file is served from the application's own origin, the script runs with the viewer's session.
How to check if you're exposed
Check your NocoDB version in the application, or the image tag if you run it in a container:
docker ps --format '{{.Image}}' | grep -i nocodb
Also review recent attachments for SVG files from users you do not expect, and check whether your instance allows broad sign up.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade NocoDB to 0.301.0 or later.
- Restrict who can upload attachments until you have upgraded.
- Review existing SVG attachments and remove any you do not recognize.
- Serve user uploads from a separate domain where you can.
- Set a Content Security Policy that blocks inline script.
Why it matters
The record lists CWE-434, unrestricted upload of a dangerous file type, and CWE-79, cross-site scripting. SVG is an image format that can carry script, so treating it as a plain image is a mistake. When the file is stored and served from the app's own origin, the script gets the same trust as the app.
The impacts the advisory lists, account compromise, data exfiltration and unauthorized actions on behalf of users, are what stored XSS in a data tool can do. A shared database is a rich target. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
SVG is code, not just an image
Teams often allow image uploads and treat all image types as safe. SVG is the exception. It is an XML format that can contain script, links and external references. When a site serves an uploaded SVG inline, under its own domain, the browser runs that script with the site's trust.
The NocoDB advisory describes exactly that: a permissive check that treats anything containing a certain type string as previewable, plus no sanitizing, so a script bearing SVG renders as if it were a photo. Because NocoDB is a shared data tool, the script runs in the session of whoever views the attachment, often a colleague with higher rights than the uploader.
Defenses that work for any app
Serve user uploads from a separate domain that has no cookies for your application, so that script in an upload cannot use a viewer's session. Send a Content-Disposition header that forces download for types you do not need to display inline. Set a Content Security Policy that blocks inline script. Where you must show SVG, sanitize it with a well maintained library, or convert it to a raster image on upload.
What to check now
Review attachments uploaded since the version you run was released, particularly SVG files from accounts that do not usually upload. Remove those you do not recognize. Review who can sign up and upload on your instance, and whether sign up is open.
After the upgrade
Confirm version 0.301.0 or later is running. Then test your own configuration: upload a harmless SVG with no script to a test base and see whether it renders inline or downloads. The goal is to know your instance's behavior, not to attack it.
If you run other low code or database tools with attachment features, run the same review there, since the weakness class is common in this kind of product.
Quick check
Why are SVG files risky?
They can contain script. If a site serves them inline from its own origin, the script runs with that site's trust.
Which version fixes it?
NocoDB 0.301.0.
Sources
Last reviewed: 19 October 2026.
