PT-2026-22634 · Nocodb · Nocodb

P- · Published 2026-03-02 · Updated 2026-03-03 · CVE-2026-28397

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html without sanitization enable stored Cross-Site Scripting (XSS). This allows for the injection of malicious scripts into comments, which are then executed when other users view those comments. The v-html directive bypasses standard HTML encoding, potentially allowing attackers to execute arbitrary JavaScript code within the context of the application.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28397

GHSA-RCPH-X7MJ-54MM

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28397.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-rcph-x7mj-54mm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rcph-x7mj-54mm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28397 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28397 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/infoflowcloud/status/2028512125027487758 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028606760349491201 · Twitter Post
• https://t.me/CVEtracker/46142 · Telegram Post
• https://twitter.com/CVEnew/status/2028510365500256593 · Twitter Post