NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.

Affected: npm: nocodb

## Summary

A **stored Cross-site Scripting (XSS)** vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment.

Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users.

---

## Vulnerability Details

NocoDB allows file attachments to be previewed inline based on their MIME type. Due to overly permissive MIME type checks and a lack of content sanitization, SVG files containing executable JavaScript are incorrectly treated as safe image content and rendered directly in the browser.

### Root Cause

The vulnerability results from a combination of **overly permissive MIME type classification** and **unsafe file serving behavior**.

#### 1. Permissive MIME Type Check

In `attachmentHelpers.ts`, files are considered previewable if their MIME type contains certain substrings:

```ts const previewableMimeTypes = ['image', 'pdf', 'video', 'audio'];

export const isPreviewAllowed = (args: { mimetype?: string } = {}) => { const { mimetype } = args; if (!mimetype) return false; return previewableMimeTypes.some((type) => mimetype.includes(type)); }; ```

This substring-based check (`includes`) causes files with the MIME…