CVE-2026-28357
CVE-2026-28357 · NocoDB: Stored Cross-Site Scripting via Formula Cell
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.
CVSS 5.3 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node