Executive brief
NocoDB is a database management platform with spreadsheet-like interface features. An authenticated user with Editor privileges can inject malicious scripts into Rich Text cells that execute when other users view the affected data, potentially compromising data integrity and user trust. The vulnerability bypasses client-side protections by sending HTML directly via the API, with the backend failing to sanitize the content before storage and display.
Technical details
The vulnerability is a Stored Cross-site Scripting (XSS) flaw in NocoDB's Rich Text field handling. An authenticated user with Editor role can bypass the TipTap editor's client-side HTML sanitization by sending raw HTML directly through the API. The backend fails to perform server-side input validation or sanitization, storing the malicious HTML directly. When other users view the cell, the content is rendered unsanitized via v-html in TextArea.vue, executing any embedded scripts. Attack requires prior authentication and user interaction (viewing the compromised cell). The vulnerability was fixed in version 0.301.3.
Affected products
- NocoDB NocoDB <= 0.301.2
Timeline
- 2026-03-02: disclosed: Vulnerability published via GitHub Advisory and GHSA
- 2026-03-02: patched: Fix released in version 0.301.3