PT-2026-22630 · Nocodb · Nocodb

Akokonunes + 1 · Published 2026-03-02 · Updated 2026-03-02 · CVE-2026-28359

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells. This is achieved by bypassing the TipTap editor and sending raw HTML via the API. The vulnerable API allows for the injection of malicious code through Rich Text cells.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28359

GHSA-QXWQ-Q265-HC44

Affected Products

Nocodb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28359.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-qxwq-q265-hc44 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qxwq-q265-hc44 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28359 · Security Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/CVEnew/status/2028510369233137737 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028614438471840134 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rj3cki/resumen_diario_de_vulnerabilidades_02032026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2028512192648130844 · Twitter Post
• https://t.me/CVEtracker/46138 · Telegram Post