5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28398

CVE-2026-28398: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells

Summary

User-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS.

Details

Comments in Comments.vue and rich text in TextArea.vue were parsed by markdown-it with html: true and injected via v-html. The codebase had vue-dompurify-html available but these paths used raw v-html. Server-side, Comment.insert() used extractProps() instead of extractPropsAndSanitize().

Commenter role is sufficient for the comments vector; Editor role for rich text.

This issue was independently reported; see also GHSA-rcph-x7mj-54mm and GHSA-wwp2-x4rj-j8rm for the same root cause found by GitHub Security Lab.

Impact

Stored XSS — malicious scripts execute for any user viewing the comment or cell.

Credit

This issue was reported by @bugbunny-research (bugbunny.ai).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28398

CVE-2026-28398:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nocodb	npm	<= 0.301.2	0.301.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue affecting NocoDB's comments and rich text cells. The root cause is the lack of input sanitization on the backend and improper rendering on the frontend.

My analysis of the commits between the vulnerable version (<= 0.301.2) and the patched version (0.301.3) confirms this. Specifically, commit c4fcf94c20d6097b2ff6cec1f1aae2caca2c7d0f is the primary security patch for the comments feature.

On the backend, this commit modifies packages/nocodb/src/services/comments.service.ts. The create and update methods within the CommentsService class were identified as vulnerable. They were accepting raw HTML content from users and persisting it to the database. The patch introduces the isomorphic-dompurify library to sanitize the comment content before it's passed to the Comment.insert and Comment.update model methods. These two service methods are the key server-side functions that would appear in a runtime profile during the exploitation of the vulnerability when a malicious comment is submitted.

On the frontend, the same commit, along with commit 468bdd63b8b3ddb1604131f7d25e227725bf6a55, replaces the dangerous v-html directive with v-dompurify-html in several Vue components (Comments.vue, ExpandedText.vue, Formula.vue, and TextArea.vue). This client-side change provides defense-in-depth by ensuring that even if unsanitized data exists in the database (e.g., from before the patch was applied), it is sanitized before being rendered in the user's browser.

Vulnerable functions

CommentsService.create

packages/nocodb/src/services/comments.service.ts

The `create` function in `CommentsService` was vulnerable to stored XSS because it directly inserted user-provided comment content into the database without sanitization. An attacker could submit a comment with malicious HTML and script tags, which would then be stored and executed in the browsers of other users viewing the comment. The patch adds sanitization using `DOMPurify.sanitize()` before the insertion.

CommentsService.update

packages/nocodb/src/services/comments.service.ts

The `update` function in `CommentsService` was vulnerable to stored XSS for the same reason as the `create` function. It allowed updating a comment with malicious, unsanitized content. The patch ensures that the comment is sanitized with `DOMPurify.sanitize()` before being updated in the database.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-28398: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells

Summary

Details

Impact

Credit

CVE-2026-28398:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

5.3

5.3

Basic Information

Basic Information

CVE-2026-28398: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells

Summary

Details

Impact

Credit

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI