CVE-2026-28397: NocoDB Stored Cross-site Scripting Vulnerability via Comments
Summary
CVE-2026-28397: NocoDB Vulnerable to Stored Cross-site Scripting via Comments. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart APIs and spreadsheets. It allows users to manage and interact with their data through a user-friendly interface. However, it has a vulnerability that allows users with the Commenter role to inject malicious scripts into comments, which can then be executed by anyone viewing those comments.
Vulnerability Detail
The vulnerability arises from the way comments are rendered in the Comments.vue component. Comments are processed using markdown-it with the html option set to true, and then injected into the DOM using v-html without proper sanitization. This lack of sanitization allows a user with Commenter privileges to insert arbitrary HTML and JavaScript, leading to stored cross-site scripting (XSS) attacks. The impact of this vulnerability is significant, as it allows attackers to execute malicious scripts on the browsers of users who view the compromised comments, potentially leading to data theft or session hijacking.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the comment feature until the package is updated. This can be done by modifying the application settings to prevent users from adding comments.
Conclusion
The vulnerability identified as CVE-2026-28397 in NocoDB allows for stored cross-site scripting through comments, posing a risk to users who view these comments. It is crucial to update to version 0.301.3 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for nocodb →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, and these scripts are stored on the server. When other users access the affected content, the scripts are executed in their browsers.
Any user with the Commenter role in NocoDB can exploit this vulnerability, and all users who view the comments are at risk of being affected by the malicious scripts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk associated with its exploitation.
While it is recommended to update to the patched version, you can manually sanitize comments by using libraries like DOMPurify before rendering them in your application.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
