CVE-2026-28359

CVE-2026-28359 · NocoDB: Stored Cross-Site Scripting via Rich Text Field

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-03-02T16:17:16.201Z
Updated: 2026-03-03T16:07:12.875Z

Stack: node

Affected products and versions

nocodb
Versions
- < 0.301.3: Affected
No fix published
nocodb npm
Affected ranges
- SEMVER: < 0.301.3
Update to 0.301.3

Original sources

https://github.com/nocodb/nocodb/security/advisories/GHSA-qxwq-q265-hc44
https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://nvd.nist.gov/vuln/detail/CVE-2026-28359

Check your server →

CVE-2026-28359 · NocoDB: Stored Cross-Site Scripting via Rich Text Field

Affected products and versions

nocodb

nocodb npm

Original sources