CVE-2026-28357

CVE-2026-28357 · NocoDB: Stored Cross-Site Scripting via Formula Cell

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-03-02T16:16:06.406Z
Updated: 2026-03-02T16:50:36.400Z

Stack: node

Affected products and versions

nocodb
Versions
- < 0.301.3: Affected
No fix published
nocodb npm
Affected ranges
- SEMVER: < 0.301.3
Update to 0.301.3

Original sources

https://github.com/nocodb/nocodb/security/advisories/GHSA-vx5p-q85x-xm3c
https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://nvd.nist.gov/vuln/detail/CVE-2026-28357

Check your server →

CVE-2026-28357 · NocoDB: Stored Cross-Site Scripting via Formula Cell

Affected products and versions

nocodb

nocodb npm

Original sources