| Package | Affected versions | Patched versions |
|---|---|---|
| nocodb | < 0.301.3 | 0.301.3 |
| nocodb | < 0.301.3 | 0.301.3 |
User-controlled content in comments and rich text cells was rendered via v-html without sanitization, enabling stored XSS.
Comments in Comments.vue and rich text in TextArea.vue were parsed by markdown-it with html: true and injected via v-html. The codebase had vue-dompurify-html available but these paths used raw v-html. Server-side, Comment.insert() used extractProps() instead of extractPropsAndSanitize().
Commenter role is sufficient for the comments vector; Editor role for rich text.
This issue was independently reported; see also GHSA-rcph-x7mj-54mm and GHSA-wwp2-x4rj-j8rm for the same root cause found by GitHub Security Lab.
Stored XSS — malicious scripts execute for any user viewing the comment or cell.
This issue was reported by @bugbunny-research (bugbunny.ai).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free