CVE-2026-28397

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored XSS. This issue has been patched in version 0.301.3.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-03-02

Last modified

2026-03-03

Weaknesses

CWE-79

Affected products

• Nocodb (Nocodb)

References

• https://github.com/nocodb/nocodb/releases/tag/0.301.3
• https://github.com/nocodb/nocodb/security/advisories/GHSA-rcph-x7mj-54mm