NocoDB has Stored Cross-site Scripting via Formula Cell
Summary
A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute.
Details
The replaceUrlsWithLink() function in urlUtils.ts converts URI::(url) patterns to <a> tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like CONCAT("URI::(https://example.com)", "<img src=x onerror=...>") to inject arbitrary scripts rendered for all viewers.
Impact
Credential theft via script execution in the context of users viewing the table.
Credit
This issue was reported by @Akokonunes.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | nocodb | < 0.301.3 | 0.301.3 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
nocodb- Disclosed
- 02.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vx5p-q85x-xm3c - CC BY 4.0
Vulnerability history: nocodb
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 54
- First → latest
- 06.2022 06.2026
- Without a fix
- 13
- Exploited in attacks
- 0
Severity breakdown
- High 7
- Medium 41
- Low 6
Disclosures per year
- 2022: 5
- 2023: 2
- 2024: 3
- 2025: 1
- 2026: 43
-
NocoDB has Stored Cross-site Scripting via Formula Cell this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.