GHSA-qxwq-q265-hc44
NocoDB Vulnerable to Stored Cross-site Scripting via Rich Text Field
Quick fix
GHSA-qxwq-q265-hc44 — nocodb: upgrade to the fixed version with the command below.
npm install nocodb@0.301.3Details
### Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API.
### Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via `v-html` in `TextArea.vue` through `NcMarkdownParser.parse()` which performs no sanitization.
### Impact Stored XSS — malicious scripts execute for any user viewing the cell.
### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).
Are you affected?
Enter the version of the package you're using.