EUVD-2026-125242

NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victi...

CVE-2026-126279

NocoDB versions prior to 2026.06.2 are vulnerable to a stored cross-site scripting (XSS) flaw in the PromptWithFields.vue component. The root cause is the rendering of unescaped field references from AI field prompts as HTML within a tooltip. An attacker with Creator privileges or higher can inje...