PT-2026-22624

CVE-2026-28357

Published

2026-03-02

Updated

2026-03-03

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.301.3

Description A stored cross-site scripting (XSS) issue exists in the Formula virtual cell of NocoDB, a software used for building databases as spreadsheets. Formula results containing URI::() patterns are rendered using v-html without proper sanitization, which allows for the execution of injected HTML.

Recommendations Update to version 0.301.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Akokonunes

Neo-Ai-Engineer

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')