Cross-site scripting in NocoDB - CVE-2026-28357
Published: April 27, 2026
Vulnerability identifier: #VU127981
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-28357
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in users' browsers.
The vulnerability exists due to cross-site scripting in the Formula virtual cell when rendering formula results containing URI::() patterns via v-html without sanitization. A remote user can create a crafted formula field value to execute arbitrary script in users' browsers.
Exploitation requires the Creator role and occurs when another user views the affected table.
Affected software
NocoDB
How to mitigate CVE-2026-28357
Install security update from vendor's website.
NocoDB - update to 0.301.3