Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-28357

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

VectorNETWORK

PublishedMar 02, 2026, 17:16

Published Bysecurity-advisories@github.com

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

nocodb(npm)00.301.3N/A

References

https://github.com/nocodb/nocodb/releases/tag/0.301.3
https://github.com/nocodb/nocodb/security/advisories/GHSA-vx5p-q85x-xm3c

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.3

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

NETWORK