CVE-2026-28401
NocoDB: Stored Cross-Site Scripting via Rich Text Cells
Summary
NocoDB: Stored Cross-Site Scripting via Rich Text Cells
Original description
The description as published by the source.
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com