GHSA-rcph-x7mj-54mm
NocoDB Vulnerable to Stored Cross-site Scripting via Comments
Quick fix
GHSA-rcph-x7mj-54mm — nocodb: upgrade to the fixed version with the command below.
npm install nocodb@0.301.3Details
### Summary Comments rendered via `v-html` without sanitization, enabling stored XSS.
### Details Comments in `Comments.vue` were parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Commenter role can inject arbitrary HTML that executes for all viewers.
### Impact Stored XSS — malicious scripts execute for any user viewing the comment.
### Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).
Are you affected?
Enter the version of the package you're using.