EUVD-2026-38602
GHSA-6mhr-74x2-98v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with low-privilege upload account required (PR:L), victim must open the link (UI:R), scope changes to victim browser (S:C), JWT theft enables full session takeover (C:H).
Primary rating from Vendor (https://github.com/nocodb/nocodb).
CVSS VectorVendor: https://github.com/nocodb/nocodb
Lifecycle Timeline
4DescriptionCVE.org
Summary
With NC_SECURE_ATTACHMENTS=true, an authenticated uploader could deliver .html or .svg attachments that the browser rendered inline from the NocoDB origin instead of forcing a download.
Details
The signed attachment handler stored response-header overrides under PascalCase keys (ResponseContentDisposition, ResponseContentType) while the controller that served the file read them under lowercase-hyphen names (response-content-disposition). The mismatch dropped the Content-Disposition: attachment header, leaving Express to auto-render .html, .svg, and similar inline. The fix corrects the key case and additionally forces Content-Disposition: attachment and Content-Type: application/octet-stream for any MIME type not on the preview allowlist.
Impact
Stored Cross-Site Scripting in the NocoDB origin from inline-rendered uploads. Script executing in the victim's browser can read the auth JWT from localStorage. Exploitation requires authenticated upload permission and the secure-attachment mode to be enabled.
Credit
This issue was reported by @bugbunny-research. It was independently reported by @DavidCarliez.
AnalysisAI
Stored Cross-Site Scripting in NocoDB (npm package, versions <= 0.301.3) allows an authenticated user with upload permissions to deliver malicious .html or .svg attachments that the victim's browser renders inline from the NocoDB origin, bypassing the intended forced-download behavior. The root cause is a header-key case mismatch in the secure attachment handler: the signed URL generator wrote overrides as PascalCase keys while the Express controller read them as lowercase-hyphen keys, silently dropping Content-Disposition: attachment and enabling inline rendering. When exploited, script executing in the victim's browser can exfiltrate the auth JWT stored in localStorage, leading to full session compromise. No public exploit code has been identified at time of analysis, and no patched version has been confirmed released.
Technical ContextAI
NocoDB is an open-source Airtable alternative built on Node.js/Express (pkg:npm/nocodb). The vulnerability resides in the signed attachment delivery subsystem, which is activated by the NC_SECURE_ATTACHMENTS=true environment variable. When this mode is enabled, the server generates signed URLs that include response-header overrides intended to force browsers to download files rather than render them. The Express-based file-serving controller, however, consumed these override keys using lowercase-hyphen naming conventions (e.g., response-content-disposition) while the signing handler had written them under PascalCase keys (e.g., ResponseContentDisposition). JavaScript object property lookups are case-sensitive, so the lookup silently returned undefined, causing the Content-Disposition: attachment and Content-Type safeguards to be omitted from HTTP responses. Express then defaulted to content-type inference, allowing .html and .svg files to be served with text/html and image/svg+xml MIME types and rendered inline by the browser in the NocoDB origin context. The CWE-79 (Improper Neutralization of Input During Web Page Generation) root cause class applies because user-supplied content was ultimately rendered in the browser without sufficient output encoding or delivery restriction.
RemediationAI
No vendor-released patch has been confirmed at time of analysis - the GHSA advisory at https://github.com/nocodb/nocodb/security/advisories/GHSA-6mhr-74x2-98v9 and https://github.com/advisories/GHSA-6mhr-74x2-98v9 describe the fix but do not list a remediated release version. Operators should monitor the NocoDB GitHub releases page and the advisory for a patched build and upgrade immediately upon availability. As a compensating control, disable NC_SECURE_ATTACHMENTS mode and configure object-storage bucket policies (e.g., AWS S3 ContentDisposition enforcement, Cloudflare R2 transform rules) to force Content-Disposition: attachment at the storage layer for all user-uploaded files - this eliminates the Express-level bypass entirely, though it requires infrastructure-level changes and may affect legitimate preview use cases. Alternatively, restrict upload permissions to the minimum set of trusted users, reducing the attacker population, but note this does not eliminate the vulnerability for those users. Block direct browser access to the NocoDB attachment endpoint via a reverse proxy that injects Content-Disposition: attachment; filename=... and X-Content-Type-Options: nosniff response headers for all served attachment paths as an additional layer, accepting that this applies broadly and may break PDF/image previews.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today