CVE-2026-28398: NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells
Summary User-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS.
Details Comments in Comments.vue and rich text in TextArea.vue were parsed by markdown-it with html: true and injected via v-html. The codebase had vue-dompurify-html available but these paths used raw v-html. Server-side, Comment.insert() used extractProps() instead of extractPropsAndSanitize().
Commenter role is sufficient for the comments vector; Editor role for rich text.
This issue was independently reported; see also GHSA-rcph-x7mj-54mm and GHSA-wwp2-x4rj-j8rm for the same root cause found by GitHub Security Lab.
Impact Stored XSS — malicious scripts execute for any user viewing the comment or cell.
Credit This issue was reported by @bugbunny-research (bugbunny.ai).
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28398?
CVE-2026-28398 has a high severity due to its potential to enable stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2026-28398?
To fix CVE-2026-28398, update NocoDB to version 0.301.3 or later.
What components of NocoDB are affected by CVE-2026-28398?
CVE-2026-28398 affects the comments in 'Comments.vue' and rich text in 'TextArea.vue' components.
Can CVE-2026-28398 lead to data compromise?
Yes, CVE-2026-28398 can lead to data compromise through unauthorized script execution in user comments.
How can I mitigate CVE-2026-28398 if I can't update?
If unable to update, consider sanitizing user input in comments and rich text cells to prevent XSS.