https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T22:54:28.647968+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274077 EUVD-2026-274077 2026-10-20T22:54:28.696061+00:00 EUVD-2026-274077 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28401 fkie_cve-2026-28401 2026-10-20T22:54:28.696097+00:00

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via v-html without sanitization enables stored XSS. This issue has been patched in version 0.301.3.

 https://cve.radiocsirt.org/vuln/ghsa-wwp2-x4rj-j8rm GHSA-wwp2-x4rj-j8rm — NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells 2026-10-20T22:54:28.696130+00:00

Affected: npm: nocodb

### Summary Rich text cell content rendered via `v-html` without sanitization, enabling stored XSS.

### Details Rich text in `TextArea.vue` was parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers.

### Impact Stored XSS — malicious scripts execute for any user viewing the cell.

### Credit This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).