~ / search / GHSA-qxwq-q265-hc44

GHSA-qxwq-q265-hc44

NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-28359

Packages

EcosystemPackageAffectedFixed in
npm nocodb < 0.301.3 0.301.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. ### Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via `v-html` in `TextArea.vue` through `NcMarkdownParser.parse()` which performs no sanitization. ### Impact Stored XSS — malicious scripts execute for any user viewing the cell. ### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).

References

External links from the advisory. They lead to third-party sites.