NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
Date: 2026-03
Affected: npm/nocodb
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-28357
CVE-2026-28359
CVE-2026-28361
CVE-2026-28397
CVE-2026-28401
CWE: CWE-639
CWE-79

### Summary Rich text cell content rendered via `v-html` without sanitization, enabling stored XSS. ### Details Rich text in `TextArea.vue` was parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers. ### Impact Stored XSS — malicious scripts execute for any user viewing the cell. ### Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).


Mitigations:

Architectural layers (MAESTRO):