Vulnerability Description
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nocodb | Nocodb | < 0.301.3 |
Related Weaknesses (CWE)
References
- https://github.com/nocodb/nocodb/releases/tag/0.301.3ProductRelease Notes
- https://github.com/nocodb/nocodb/security/advisories/GHSA-qxwq-q265-hc44Vendor Advisory
FAQ
What is CVE-2026-28359?
CVE-2026-28359 is a vulnerability with a CVSS score of 5.4 (MEDIUM). NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap edito...
How severe is CVE-2026-28359?
CVE-2026-28359 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-28359?
Check the references section above for vendor advisories and patch information. Affected products include: Nocodb Nocodb.