CVE-2026-28357

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

• CWE-79

• https://github.com/nocodb/nocodb/releases/tag/0.301.3Product, Release Notes
• https://github.com/nocodb/nocodb/security/advisories/GHSA-vx5p-q85x-xm3cVendor Advisory

Published

Mar 2, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28351pypdf is a free and open-source pure-python PDF library. Pri…5.3
• CVE-2026-28352Indico is an event management system that uses Flask-Multipa…6.5
• CVE-2026-28353Trivy Vulnerability Scanner is a VS Code extension that help…10
• CVE-2026-28354ClipBucket v5 is an open source video sharing platform. Prio…6.5
• CVE-2026-28355Canarytokens help track activity and actions on a network. V…1.3
• CVE-2026-28356multipart is a fast multipart/form-data parser for python. P…7.5
• CVE-2026-28358NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-28359NocoDB is software for building databases as spreadsheets. P…5.4
• CVE-2026-2836A cache poisoning vulnerability has been found in the Pingor…8.1
• CVE-2026-28360NocoDB is software for building databases as spreadsheets. P…5.3
• CVE-2026-28361NocoDB is software for building databases as spreadsheets. P…6.3
• CVE-2026-28363In OpenClaw before 2026.2.23, tools.exec.safeBins validation…8.8