| Package | Affected versions | Patched versions |
|---|---|---|
| nocodb | < 0.301.3 | 0.301.3 |
| nocodb | < 0.301.3 | 0.301.3 |
A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute.
The replaceUrlsWithLink() function in urlUtils.ts converts URI::(url) patterns to <a> tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like CONCAT("URI::(https://example.com)", "<img src=x onerror=...>") to inject arbitrary scripts rendered for all viewers.
Credential theft via script execution in the context of users viewing the table.
This issue was reported by @Akokonunes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free