https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T06:56:29.706133+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-273885 EUVD-2026-273885 2026-10-23T06:56:29.764932+00:00 EUVD-2026-273885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28357 fkie_cve-2026-28357 2026-10-23T06:56:29.764968+00:00

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.

 https://cve.radiocsirt.org/vuln/ghsa-vx5p-q85x-xm3c GHSA-vx5p-q85x-xm3c — NocoDB has Stored Cross-site Scripting via Formula Cell 2026-10-23T06:56:29.765001+00:00

Affected: npm: nocodb

### Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing `URI::()` patterns are rendered via `v-html` without sanitization, allowing injected HTML to execute.

### Details The `replaceUrlsWithLink()` function in `urlUtils.ts` converts `URI::(url)` patterns to `<a>` tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like `CONCAT("URI::(https://example.com)", "<img src=x onerror=...>")` to inject arbitrary scripts rendered for all viewers.

### Impact Credential theft via script execution in the context of users viewing the table.

### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).