Medium
NocoDB: Stored Cross-Site Scripting via Rich Text Field
Type: advisorySources: OSV
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-28359
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 17:15 UTC · Revision 1
Source evidence
NocoDB: Stored Cross-Site Scripting via Rich Text Field
core-osv · Original sourcePublished 2 Mar 2026, 16:17 UTC
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.
osv:CVE-2026-28359
Complete source record
{
"id": "f95e86271f69528f101b952168307b96858798317d9dbcd17aca35fe86743ee7",
"url": "https://osv.dev/vulnerability/CVE-2026-28359",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "NocoDB: Stored Cross-Site Scripting via Rich Text Field",
"summary": "NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.",
"evidence": "osv:CVE-2026-28359",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-28359",
"aliases": [
"CVE-2026-28359",
"GHSA-qxwq-q265-hc44"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nocodb/nocodb",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "391834484b11c429e4ff5677538b3b2f16ca510d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.301.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "391834484b11c429e4ff5677538b3b2f16ca510d"
}
],
"source": "REFERENCES_TAG",
"original_tag": "0.301.3"
},
{
"cpe": "cpe:2.3:a:nocodb:nocodb:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.301.3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"0.301.2",
"0.301.1",
"0.301.0",
"0.300.0",
"0.265.1",
"0.265.0",
"0.264.9",
"0.264.8",
"0.264.7",
"0.264.6",
"0.264.4",
"0.264.3",
"0.264.2",
"0.264.1",
"0.264.0",
"0.263.8",
"0.263.7",
"0.263.6",
"0.263.4",
"0.263.3",
"0.263.2",
"0.263.1",
"0.263.0",
"0.262.5",
"0.262.4",
"0.262.3",
"0.262.2",
"0.262.1",
"0.262.0",
"0.261.0",
"0.260.7",
"0.260.6",
"0.260.5",
"0.260.4",
"0.260.3",
"0.260.2",
"0.260.1",
"0.260.0",
"0.258.11",
"0.258.10",
"0.258.3",
"0.258.2",
"0.258.1",
"0.258.0",
"0.257.2",
"0.257.0",
"0.256.0",
"0.255.2",
"0.255.1",
"0.255.0",
"0.253.0",
"0.252.0",
"0.251.3",
"0.251.2",
"0.251.1",
"0.251.0",
"0.250.2",
"0.250.1",
"0.250.0",
"0.207.3",
"0.207.2",
"0.207.1",
"0.207.0",
"0.205.1",
"0.205.0",
"0.204.9",
"0.204.8",
"0.204.7",
"0.204.6",
"0.204.5",
"0.204.4",
"0.204.3",
"0.204.2",
"0.204.1",
"0.204.0",
"0.203.2",
"0.203.1",
"0.203.0",
"0.202.10",
"0.202.9",
"0.202.8",
"0.202.7",
"0.202.6",
"0.202.5",
"0.202.0",
"0.200.0",
"0.111.4",
"0.111.3",
"0.111.2",
"0.111.1",
"0.111.0",
"0.109.7",
"0.109.6",
"0.109.5",
"0.109.4",
"0.109.3",
"0.109.2",
"0.109.1",
"0.109.0",
"0.108.1",
"0.108.0",
"0.108.0-beta.0",
"0.107.5",
"0.107.4",
"0.107.3",
"0.107.2",
"0.107.1",
"0.107.0",
"0.107.0-beta.1",
"0.107.0-beta.0",
"0.106.1",
"0.106.0",
"0.106.0-beta.1",
"0.106.0-beta.0",
"0.105.3",
"0.105.2",
"0.105.1",
"0.105.0",
"0.104.3",
"0.104.2",
"0.104.1",
"0.101.2",
"0.101.0",
"0.101.0-beta.0",
"0.100.2",
"0.100.1",
"0.100.0",
"0.99.2",
"0.99.1",
"0.99.0",
"0.98.4",
"0.98.3",
"0.98.2",
"0.98.1",
"0.97.0",
"0.96.4",
"0.96.0",
"0.92.4",
"0.92.3",
"0.92.2",
"0.92.0",
"0.92.1",
"0.91.10",
"0.91.9",
"0.91.8",
"0.91.7",
"0.91.6",
"0.91.1",
"0.91.0",
"0.90.11",
"0.90.10",
"0.90.9",
"0.90.8",
"0.90.7",
"0.90.4",
"0.90.3",
"0.90.1",
"0.90.0",
"0.84.16",
"0.84.15",
"0.84.14",
"0.84.13",
"0.84.12",
"0.84.10",
"0.84.9",
"0.84.8",
"0.84.7",
"0.84.6",
"0.84.3",
"0.84.2",
"0.84.1",
"0.83.8",
"0.83.6",
"0.83.5",
"0.83.4",
"0.83.3",
"0.83.2",
"0.83.1",
"0.83.0",
"0.82.0",
"0.81.1",
"0.81.0",
"0.80.0",
"0.11.46",
"0.11.45",
"0.11.44",
"0.11.43",
"0.11.42",
"0.11.41",
"0.11.40",
"0.11.39",
"0.11.36",
"0.11.34",
"0.11.33",
"0.11.31",
"0.11.30",
"0.11.29",
"0.11.28",
"0.11.26",
"0.11.22",
"0.11.25",
"0.11.24",
"0.11.23",
"0.11.21",
"0.11.20",
"0.11.19",
"0.11.18",
"0.11.17",
"0.11.16",
"0.11.15",
"0.11.14",
"0.11.12",
"0.11.11",
"0.11.10",
"0.11.9",
"0.11.7",
"0.11.6",
"0.11.5",
"0.11.4",
"0.11.3",
"0.11.1",
"0.11.0",
"0.10.6",
"0.10.5",
"0.10.4",
"0.10.3",
"0.10.2",
"0.10.1",
"v0.10.0",
"0.10.0",
"0.9",
"0.4.9",
"0.4.8",
"0.4.5",
"v0.4.4",
"v0.4.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28359.json"
}
}
],
"modified": "2026-10-28T02:30:37.777804302Z",
"provider": "osv",
"references": [
"https://github.com/nocodb/nocodb/releases/tag/0.301.3",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28359.json",
"https://github.com/nocodb/nocodb/security/advisories/GHSA-qxwq-q265-hc44",
"https://nvd.nist.gov/vuln/detail/CVE-2026-28359"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28359.json"
}
},
"related_cves": [
{
"value": "CVE-2026-28359",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505226,
"published_at": "2026-03-02T16:17:16.201+00:00"
}