CVE-2026-28401: NocoDB: Stored Cross-Site Scripting via Rich Text Cells
Summary Rich text cell content rendered via v-html without sanitization, enabling stored XSS.
Details Rich text in TextArea.vue was parsed by markdown-it with html: true and injected via v-html without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers.
Impact Stored XSS — malicious scripts execute for any user viewing the cell.
Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter Stockli) and @m-y-mo (Man Yue Mo).
Other sources
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28401?
CVE-2026-28401 is classified as a stored cross-site scripting vulnerability, which could allow an attacker to execute scripts in the context of a user's session.
How do I fix CVE-2026-28401?
To fix CVE-2026-28401, upgrade NocoDB to version 0.301.3 or later, which includes a patch for this vulnerability.
What software is affected by CVE-2026-28401?
CVE-2026-28401 affects NocoDB versions prior to 0.301.3.
How does CVE-2026-28401 exploit work?
CVE-2026-28401 exploits the lack of sanitization of rich text content rendered via v-html, leading to potential stored XSS.
Who can be affected by CVE-2026-28401?
Anyone using an affected version of NocoDB can be susceptible to CVE-2026-28401, particularly users with editing capabilities.