CVE-2026-28359: NocoDB: Stored Cross-Site Scripting via Rich Text Field
Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API.
Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via v-html in TextArea.vue through NcMarkdownParser.parse() which performs no sanitization.
Impact Stored XSS — malicious scripts execute for any user viewing the cell.
Credit This issue was reported by @Akokonunes.
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28359?
CVE-2026-28359 is a medium severity vulnerability due to its potential for impacting user data through stored cross-site scripting.
How do I fix CVE-2026-28359?
To fix CVE-2026-28359, update NocoDB to version 0.301.3 or later to ensure proper HTML sanitization.
Who is affected by CVE-2026-28359?
CVE-2026-28359 affects NocoDB versions prior to 0.301.3, specifically impacting authenticated users with Editor role.
What kind of attack can leverage CVE-2026-28359?
CVE-2026-28359 can be exploited to perform stored cross-site scripting attacks by injecting malicious HTML into Rich Text fields.
What versions of NocoDB are vulnerable to CVE-2026-28359?
NocoDB versions up to and including 0.301.2 are vulnerable to CVE-2026-28359.