GitHub Advisoryadvisory · npm

GHSA-qxwq-q265-hc44 NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field

MEDIUM Published 2026-03-02 Modified 2026-03-02 Official page ↗
Aliases
CVE-2026-28359
Ecosystem
npm
Packages
nocodb
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2026-03-02

Affected packages

• npm nocodb: < 0.301.3 → fixed in 0.301.3

Description

Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via `v-html` in `TextArea.vue` through `NcMarkdownParser.parse()` which performs no sanitization. Impact Stored XSS — malicious scripts execute for any user viewing the cell. Credit This issue was reported by @Akokonunes.

Related

Alias · CVE (1)

  • CVE-2026-28359 NocoDB is software for building databases as spreadsheets. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References