CVE-2026-28398

CVE-2026-28398 · NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS. This issue has been patched in version 0.301.3.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-03-02T16:19:23.356Z
Updated: 2026-03-03T15:55:30.946Z

Stack: node

Affected products and versions

nocodb
Versions
- < 0.301.3: Affected
No fix published
nocodb npm
Affected ranges
- SEMVER: < 0.301.3
Update to 0.301.3

Original sources

https://github.com/nocodb/nocodb/security/advisories/GHSA-8vm4-g489-v3w7
https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://nvd.nist.gov/vuln/detail/CVE-2026-28398

Check your server →

CVE-2026-28398 · NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells

Affected products and versions

nocodb

nocodb npm

Original sources