CVE-2026-28397

Description

### Summary Comments rendered via `v-html` without sanitization, enabling stored XSS. ### Details Comments in `Comments.vue` were parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Commenter role can inject arbitrary HTML that executes for all viewers. ### Impact Stored XSS — malicious scripts execute for any user viewing the comment. ### Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).

Affected packages (1)

• npm/nocodbfrom 0, < 0.301.3

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-28397
• PATCHhttps://github.com/nocodb/nocodb
• WEBhttps://github.com/nocodb/nocodb/releases/tag/0.301.3
• WEBhttps://github.com/nocodb/nocodb/security/advisories/GHSA-rcph-x7mj-54mm