Executive brief
NocoDB is an open-source database management platform that allows users to add comments and edit rich text fields in collaborative databases. A vulnerability allows attackers with basic editing permissions to inject malicious scripts into comments or rich text cells that automatically execute for any other user viewing that content, potentially stealing session tokens, credentials, or sensitive data visible on the page.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in NocoDB's Comments.vue and TextArea.vue components. User-controlled content is parsed by markdown-it (with HTML rendering enabled) and then injected directly into the DOM via Vue's v-html directive without sanitization, even though vue-dompurify-html is available in the codebase. Server-side, Comment.insert() uses extractProps() instead of the safer extractPropsAndSanitize() function. Attack requires Commenter role for comments vector or Editor role for rich text cells—no administrative access needed. The malicious payload persists in the database and executes each time the comment or cell is viewed by any user. Fixed in version 0.301.3.
Affected products
- NocoDB NocoDB <= 0.301.2
Timeline
- 2026-03-02: disclosed: NVD published
- 2026-03-03: patched: Version 0.301.3 released with fix