https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 06:56:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-273885 EUVD-2026-273885 https://cve.radiocsirt.org/vuln/euvd-2026-273885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28357 <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists in the Formula virtual cell. Formula results containing URI::() patterns are rendered via v-html without sanitization, allowing injected HTML to execute. This issue has been patched in version 0.301.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28357 https://cve.radiocsirt.org/vuln/ghsa-vx5p-q85x-xm3c <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing `URI::()` patterns are rendered via `v-html` without sanitization, allowing injected HTML to execute.</p> <p>### Details The `replaceUrlsWithLink()` function in `urlUtils.ts` converts `URI::(url)` patterns to `&lt;a&gt;` tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like `CONCAT(&#34;URI::(https://example.com)&#34;, &#34;&lt;img src=x onerror=...&gt;&#34;)` to inject arbitrary scripts rendered for all viewers.</p> <p>### Impact Credential theft via script execution in the context of users viewing the table.</p> <p>### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing `URI::()` patterns are rendered via `v-html` without sanitization, allowing injected HTML to execute.</p> <p>### Details The `replaceUrlsWithLink()` function in `urlUtils.ts` converts `URI::(url)` patterns to `&lt;a&gt;` tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like `CONCAT(&#34;URI::(https://example.com)&#34;, &#34;&lt;img src=x onerror=...&gt;&#34;)` to inject arbitrary scripts rendered for all viewers.</p> <p>### Impact Credential theft via script execution in the context of users viewing the table.</p> <p>### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).</p> https://cve.radiocsirt.org/vuln/ghsa-vx5p-q85x-xm3c