CVE-2026-53929: NocoDB: Stored Cross-Site Scripting via Secure Attachment

June 17, 2026 (updated July 20, 2026)

With NC_SECURE_ATTACHMENTS=true, an authenticated uploader could deliver .html or .svg attachments that the browser rendered inline from the NocoDB origin instead of forcing a download.

References

github.com/advisories/GHSA-6mhr-74x2-98v9
github.com/nocodb/nocodb/security/advisories/GHSA-6mhr-74x2-98v9
nvd.nist.gov/vuln/detail/CVE-2026-53929

Code Behaviors & Features

Detect and mitigate CVE-2026-53929 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →