PT-2026-22637 · Nocodb · Nocodb

P- · Published 2026-03-02 · Updated 2026-03-03 · CVE-2026-28401

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization allows for stored cross-site scripting (XSS). The issue occurs because content is rendered without proper sanitization, potentially allowing malicious scripts to be executed.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28401

GHSA-WWP2-X4RJ-J8RM

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28401.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-wwp2-x4rj-j8rm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28401 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wwp2-x4rj-j8rm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28401 · Security Note
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/CVEnew/status/2028510362497175690 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028601640593318307 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028512074012266520 · Twitter Post
• https://t.me/CVEtracker/46145 · Telegram Post