← Database

CVE-2026-28357

MEDIUM CVSS: 5.4 Published: 2026-03-02 Modified: 2026-06-17

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

Affected Platforms

Nocodb Nocodb

Weakness Type

CWE-79

References