CVE-2026-28357 NocoDB: Stored Cross-Site Scripting via Formula Cell

Medium 5.3 Published 2 Mar 2026 Updated 2 Mar 2026

Attackers can execute arbitrary scripts in victim browsers by injecting malicious HTML into Formula cells, potentially leading to session hijacking or data theft.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-28357?

CVE-2026-28357 is a medium-severity cross-site scripting vulnerability in nocodb, published on 2 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

Weakness: CWE-79

Which versions are affected by CVE-2026-28357?

2 open source packages ship an affected version, including nocodb. It affects 1 product.

Package	Affected	Fixed in
`nocodb` npm	All versions	`0.301.3`
`nocodb` npm	All versions	`0.301.3`

Products include Nocodb Nocodb.

How do I fix CVE-2026-28357?

Upgrade nocodb to 0.301.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-28357 being exploited?

There is no known exploitation of CVE-2026-28357 in the wild and no public exploit code.

Sources

Also known as GHSA-vx5p-q85x-xm3c.