PT-2026-22637 · Nocodb · Nocodb

P- · CVE-2026-28401 · Published 2026-03-02 · Updated 2026-03-03

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization allows for stored cross-site scripting (XSS). The issue occurs because content is rendered without proper sanitization, potentially allowing malicious scripts to be executed.

Recommendations Update to version 0.301.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-28401

GHSA-WWP2-X4RJ-J8RM

Affected Products

Nocodb

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28401.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-wwp2-x4rj-j8rm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28401 · Security Note
• https://osv.dev/vulnerability/GHSA-wwp2-x4rj-j8rm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28401 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://github.com/nocodb/nocodb/releases/tag/0.301.3 · Note
• https://twitter.com/infoflowcloud/status/2028512074012266520 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028601640593318307 · Twitter Post
• https://t.me/CVEtracker/46145 · Telegram Post
• https://twitter.com/CVEnew/status/2028510362497175690 · Twitter Post