CVE-2026-28401: NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
Summary
CVE-2026-28401: NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells. Affects nocodb versions < 0.301.3. Fixed in 0.301.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NocoDB is an open-source platform that transforms databases into smart spreadsheets, enabling users to manage data efficiently. It allows users to create rich text cells for enhanced data representation. However, a vulnerability exists in how rich text content is rendered, exposing users to potential security risks.
Vulnerability Detail
The vulnerability arises from the handling of rich text in the TextArea.vue component, where content is parsed using markdown-it with the html option set to true. This content is then injected into the DOM using v-html without proper sanitization via DOMPurify. As a result, a user with Editor role can inject malicious HTML and JavaScript, leading to stored Cross-Site Scripting (XSS) attacks that execute for all users viewing the affected cell. This vulnerability can compromise user data and application integrity.
How To Fix
Latest published version: 0.301.3 as of 22 Oct 2026
npm install nocodb@0.301.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using rich text cells for sensitive data until the package is updated. Additionally, consider implementing server-side validation and sanitization of user inputs to mitigate the risk of XSS attacks.
Conclusion
The vulnerability identified as CVE-2026-28401 in NocoDB allows for stored Cross-Site Scripting through rich text cells, posing a risk to users. It is crucial to update to version 0.301.3 or later to mitigate this risk. Users should also consider temporary workarounds until the update can be applied.
See every vulnerability recorded for nocodb →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into a web application, which are then stored on the server and executed when other users access the affected content.
Any user with the Editor role in NocoDB can exploit this vulnerability, potentially affecting all users who view the rich text cells.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
If you cannot update the package right away, implement server-side input validation and avoid using rich text cells for sensitive data as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for nocodb.
