CVE-2026-28401

CVE-2026-28401 · NocoDB: Stored Cross-Site Scripting via Rich Text Cells

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-03-02T16:20:00.697Z
Updated: 2026-03-03T15:53:33.578Z

Stack: node

Affected products and versions

nocodb
Versions
- < 0.301.3: Affected
No fix published
nocodb npm
Affected ranges
- SEMVER: < 0.301.3
Update to 0.301.3

Original sources

https://github.com/nocodb/nocodb/security/advisories/GHSA-wwp2-x4rj-j8rm
https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://nvd.nist.gov/vuln/detail/CVE-2026-28401

Check your server →

CVE-2026-28401 · NocoDB: Stored Cross-Site Scripting via Rich Text Cells

Affected products and versions

nocodb

nocodb npm

Original sources