CVE-2026-28397: NocoDB: Stored Cross-Site Scripting via Comments
Summary Comments rendered via v-html without sanitization, enabling stored XSS.
Details Comments in Comments.vue were parsed by markdown-it with html: true and injected via v-html without DOMPurify. A user with Commenter role can inject arbitrary HTML that executes for all viewers.
Impact Stored XSS — malicious scripts execute for any user viewing the comment.
Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter Stockli) and @m-y-mo (Man Yue Mo).
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28397?
CVE-2026-28397 is classified as a high severity vulnerability due to its potential for stored cross-site scripting (XSS).
How do I fix CVE-2026-28397?
To fix CVE-2026-28397, upgrade NocoDB to version 0.301.3 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-28397?
CVE-2026-28397 affects NocoDB versions up to 0.301.2, specifically impacting users with the Commenter role.
What types of attacks are possible with CVE-2026-28397?
CVE-2026-28397 allows an attacker to execute malicious scripts in the context of a user's browser session, leading to potential data theft or session hijacking.
What specific component of NocoDB is vulnerable in CVE-2026-28397?
The vulnerability in CVE-2026-28397 exists in the Comments.vue component, where comments are rendered using untrusted content via v-html.