CVE-2026-28398: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Summary
CVE-2026-28398: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, allowing users to manage data easily. It supports various database backends and provides features like collaborative editing, rich text formatting, and comments. However, a vulnerability has been identified that allows for stored cross-site scripting (XSS) attacks through user-generated content in comments and rich text cells.
Vulnerability Detail
The vulnerability arises from the rendering of user-controlled content in comments and rich text cells via 'v-html' without proper sanitization. Specifically, the comments in 'Comments.vue' and rich text in 'TextArea.vue' are parsed using markdown-it with 'html: true' and injected directly into the DOM. This allows attackers to inject malicious scripts that execute when other users view the affected comments or cells. The issue is exacerbated by the use of 'extractProps()' in 'Comment.insert()', which does not sanitize the input, making it possible for users with the commenter role to exploit this vulnerability.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the rendering of comments and rich text cells using 'v-html' until you can apply the patch. Instead, consider using a safer method to render user input, such as 'vue-dompurify-html' to sanitize the content before rendering.
Conclusion
The vulnerability identified as CVE-2026-28398 in NocoDB allows for stored cross-site scripting through unprotected comments and rich text cells. It is crucial to update to the patched version 0.301.3 or later to mitigate this risk. Users should also consider implementing workarounds until the update can be applied.
See every vulnerability recorded for nocodb →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed in the browsers of users who access the affected content.
Any user who views comments or rich text cells in NocoDB could be affected, especially if they have the commenter or editor role.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, implement the suggested workaround by disabling the use of 'v-html' for rendering user-generated content until the update can be applied.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
