CVE-2026-24769

CriticalPublic PoC

Published: 28 January 2026

Published

28 January 2026

Modified

04 February 2026

KEV Added

—

Patch

—

CVSS Score 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Score 0.0002 5.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24769 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Nocodb Nocodb. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Drive-by Compromise (T1189) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation requires applying the vendor patch in NocoDB version 0.301.0, which directly fixes the insecure SVG attachment rendering vulnerability.

SI-15 Information Output Filtering good match

prevent

Information output filtering sanitizes or escapes rendered attachment content to block execution of embedded JavaScript in SVG files viewed by users.

SI-10 Information Input Validation good match

prevent

Information input validation scans and rejects uploaded SVG files containing malicious JavaScript payloads during attachment handling.

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Stored XSS via malicious SVG upload in public-facing NocoDB web app directly enables server-side exploitation (T1190) that delivers client-side JS execution (T1059.007) to victims viewing content (T1189/T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and…

executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.

Deeper analysisAI

CVE-2026-24769 is a stored cross-site scripting (XSS) vulnerability in NocoDB, an open-source software platform for building databases as spreadsheets. The issue resides in the attachment handling mechanism and affects versions prior to 0.301.0. It allows authenticated users to upload malicious SVG files containing embedded JavaScript, which are stored server-side and rendered inline when viewed by other users, leading to arbitrary code execution in the victims' browsers under the application's origin. The vulnerability is associated with CWE-79 (Cross-Site Scripting) and CWE-434 (Unrestricted Upload of File with Dangerous Type), earning a CVSS v3.1 base score of 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

An attacker with low-privilege authenticated access (PR:L) can exploit this by uploading a specially crafted SVG attachment to a shared resource. When other users, potentially with higher privileges, view the attachment, the embedded JavaScript executes in their browser context. This enables severe impacts including account takeover, data exfiltration from the application, and unauthorized actions performed on behalf of the victim, such as modifying records or escalating privileges, due to the cross-origin resource sharing (S:C) scope change.

The official patch is available in NocoDB version 0.301.0, which addresses the insecure rendering of SVG attachments. Additional details and remediation guidance are provided in the GitHub Security Advisory at https://github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr, published on 2026-01-28. Security practitioners should upgrade affected instances immediately and review attachment upload policies as an interim measure.