NocoDB’s attachment handling has a stored cross‑site scripting flaw where authenticated users can upload malicious SVG files that contain JavaScript. When another user opens the attachment the script runs in the context of the application’s origin, potentially compromising the viewing account and allowing data exfiltration or unauthorized actions. The weakness is classified as CWE‑79 (XSS) and CWE‑434 (Improper Restriction of XML or other code syntaxes).

The vulnerability affects all installations of NocoDB prior to version 0.301.0; the product is distributed under the name NocoDB and is identified in the NOCODB namespace. Any deployment of these earlier releases with enabled SVG upload capability is vulnerable.

The CVSS base score is 8.5, indicating high severity, but the current EPSS score is less than 1%, suggesting that exploitation is unlikely at the present time. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to upload a crafted SVG and a second user to view it; once the payload executes, the attacker can compromise the victim’s account and perform actions as that user.