5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28401

CVE-2026-28401: NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells

Summary

Rich text cell content rendered via v-html without sanitization, enabling stored XSS.

Details

Rich text in TextArea.vue was parsed by markdown-it with html: true and injected via v-html without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers.

Impact

Stored XSS — malicious scripts execute for any user viewing the cell.

Credit

This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members @p- (Peter Stockli) and @m-y-mo (Man Yue Mo).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28401

CVE-2026-28401:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nocodb	npm	<= 0.301.2	0.301.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within NocoDB's rich text and comment functionalities. The root cause is the rendering of user-provided content directly into the DOM using Vue.js's v-html directive without prior sanitization. The vulnerability description specifically highlights TextArea.vue where rich text from a cell is rendered. The analysis of the patches between the vulnerable version 0.301.2 and the patched version 0.301.3 confirms this and reveals a broader scope of the issue.

The primary fix is in commit 468bdd63b8b3ddb1604131f7d25e227725bf6a55, which replaces v-html with v-dompurify-html in packages/nc-gui/components/cell/TextArea.vue. This directly addresses the vulnerability mentioned in the advisory.

A related commit, c4fcf94c20d6097b2ff6cec1f1aae2caca2c7d0f, applies the same fix to other components (Comments.vue, ExpandedText.vue, Formula.vue) that were also improperly using v-html. Furthermore, this commit adds backend sanitization in packages/nocodb/src/services/comments.service.ts within the commentCreate and commentUpdate functions, providing defense-in-depth by cleaning the data before it's even stored in the database.

An attacker with permissions to edit rich text fields or post comments could inject a malicious script. When another user views the compromised rich text cell or comment, the script would execute in their browser, potentially leading to session hijacking, data theft, or further attacks. The identified vulnerable functions are the points where either the unsanitized data is processed on the backend or rendered on the frontend.

Vulnerable functions

TextArea.vue

packages/nc-gui/components/cell/TextArea.vue

The `TextArea.vue` component was vulnerable to stored XSS because it used the `v-html` directive to render rich text content (`richTextContent`) without proper sanitization. An attacker could inject malicious HTML and script content, which would be executed in the browser of any user viewing the cell. The patch replaced `v-html` with `v-dompurify-html` to sanitize the content before rendering.

Comments.vue

packages/nc-gui/components/smartsheet/expanded-form/Sidebar/Comments.vue

The `Comments.vue` component was vulnerable to stored XSS. It used `v-html` to render comment content (`parsedHtmlComments[commentItem.id]`) without sanitization. This allowed for the execution of arbitrary scripts injected into comments. The fix replaces `v-html` with `v-dompurify-html` to ensure the content is sanitized.

ExpandedText.vue

packages/nc-gui/components/smartsheet/grid/canvas/components/ExpandedText.vue

The `ExpandedText.vue` component was vulnerable to stored XSS because it rendered content via `v-html` without sanitization. This could allow malicious scripts to be executed. The patch mitigates this by replacing `v-html` with `v-dompurify-html`.

Formula.vue

packages/nc-gui/components/virtual-cell/Formula.vue

The `Formula.vue` component was vulnerable to stored XSS. It used `v-html` to render formula results, which could contain malicious HTML, without sanitization. The fix was to replace `v-html` with `v-dompurify-html` to sanitize the output.

CommentsService.commentCreate

packages/nocodb/src/services/comments.service.ts

The `commentCreate` function in `CommentsService` was vulnerable as it accepted and stored comment data without sanitization. This allowed malicious HTML and script content to be saved to the database, leading to stored XSS when the comment was rendered. The patch adds server-side sanitization using `DOMPurify.sanitize()` before inserting the comment.

CommentsService.commentUpdate

packages/nocodb/src/services/comments.service.ts

The `commentUpdate` function in `CommentsService` was vulnerable because it allowed updating a comment with unsanitized content. This could lead to stored XSS if a malicious payload was provided. The fix introduces server-side sanitization of the comment body using `DOMPurify.sanitize()` before updating the database record.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.