VULNERABILITY INTELLIGENCE

CVE-2026-28357

CVSS score5.4 MEDIUM
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-03-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references