CVE-2026-28359: NocoDB Stored Cross-site Scripting Vulnerability in Rich Text Field
Summary
CVE-2026-28359: NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, enabling users to manage data easily. It features a rich text editor for enhanced content formatting. However, a vulnerability exists that allows authenticated users with Editor roles to inject malicious HTML into Rich Text cells, compromising the integrity of the application.
Vulnerability Detail
The vulnerability arises from the TipTap editor's client-side HTML sanitization, which is bypassed when raw HTML is sent via the API. The backend stores this unsanitized HTML, which is then rendered without any server-side sanitization in the TextArea.vue component. This leads to stored Cross-site Scripting (XSS), where malicious scripts can execute for any user viewing the affected cell, potentially leading to data theft or unauthorized actions.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the Editor role permissions to prevent users from injecting raw HTML until the package is updated. Additionally, consider implementing server-side sanitization for any HTML content processed by the application.
Conclusion
The stored XSS vulnerability in NocoDB's Rich Text Field poses a significant risk to users. It is crucial to update to the latest version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for nocodb →
FAQ
The vulnerability is a stored Cross-site Scripting (XSS) issue that allows attackers to inject malicious scripts into Rich Text cells.
Authenticated users with Editor roles in NocoDB are primarily affected, as they can exploit this vulnerability.
Malicious scripts can execute for any user viewing the affected Rich Text cell, leading to data theft or unauthorized actions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
