CVE-2026-28357: NocoDB: Stored Cross-Site Scripting via Formula Cell
Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute.
Details The replaceUrlsWithLink() function in urlUtils.ts converts URI::(url) patterns to <a> tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like CONCAT("URI::(https://example.com)", "<img src=x onerror=...>") to inject arbitrary scripts rendered for all viewers.
Impact Credential theft via script execution in the context of users viewing the table.
Credit This issue was reported by @Akokonunes.
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28357?
CVE-2026-28357 is classified as a stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-28357?
To mitigate CVE-2026-28357, upgrade to NocoDB version 0.301.3 or later.
What software is affected by CVE-2026-28357?
CVE-2026-28357 affects NocoDB versions up to 0.301.2.
What kind of attack can be performed using CVE-2026-28357?
An attacker can execute arbitrary HTML and JavaScript in a user's browser session through the stored XSS vulnerability.
What specific component of NocoDB is vulnerable in CVE-2026-28357?
The vulnerability in CVE-2026-28357 exists in the Formula virtual cell's handling of input within the application.