Executive brief
NocoDB is an open-source database management and collaboration platform. A stored cross-site scripting vulnerability in the rich text cell component allows users with editor permissions to inject malicious JavaScript code that executes in the browsers of all other users who view the affected cell, potentially leading to account takeover, data theft, or malware distribution.
Technical details
The vulnerability exists in TextArea.vue where rich text content is processed by markdown-it with the html: true option enabled, then injected into the DOM via Vue's v-html directive without DOMPurify sanitization. This allows an attacker with Editor role privileges to craft HTML/JavaScript payloads that persist in the database and execute client-side for any user viewing the cell. The attack requires the attacker to have editor-level access to create or modify a rich text cell, but once injected, the malicious script runs for all subsequent viewers without authentication requirements. The vulnerability has been patched in version 0.301.3.
Affected products
- NocoDB NocoDB <= 0.301.2
Timeline
- 2026-03-03: disclosed
- 2026-03-03: patched: Fixed in version 0.301.3