PT-2026-22635 · Nocodb · Nocodb

Bugbunny-Research · Published 2026-03-02 · Updated 2026-03-03 · CVE-2026-28398

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored cross-site scripting (XSS). The issue occurs because content provided by users is not properly processed before being displayed, potentially allowing malicious code to be executed within the application.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28398

GHSA-8VM4-G489-V3W7

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28398.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-8vm4-g489-v3w7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vm4-g489-v3w7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28398 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28398 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/infoflowcloud/status/2028512107960922131 · Twitter Post
• https://twitter.com/CVEnew/status/2028510364577497116 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028611878969078108 · Twitter Post
• https://t.me/CVEtracker/46143 · Telegram Post