https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 08:36:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274093 EUVD-2026-274093 https://cve.radiocsirt.org/vuln/euvd-2026-274093 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28359 <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.</p> <p>NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API. This issue has been patched in version 0.301.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28359 https://cve.radiocsirt.org/vuln/ghsa-qxwq-q265-hc44 <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API.</p> <p>### Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via `v-html` in `TextArea.vue` through `NcMarkdownParser.parse()` which performs no sanitization.</p> <p>### Impact Stored XSS — malicious scripts execute for any user viewing the cell.</p> <p>### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).</p> <p><strong>Affected:</strong> npm: nocodb</p> <p>### Summary An authenticated user with Editor role can inject arbitrary HTML into Rich Text cells by bypassing the TipTap editor and sending raw HTML via the API.</p> <p>### Details The TipTap editor sanitizes HTML client-side, but the backend stores raw HTML without server-side sanitization. The stored content is rendered via `v-html` in `TextArea.vue` through `NcMarkdownParser.parse()` which performs no sanitization.</p> <p>### Impact Stored XSS — malicious scripts execute for any user viewing the cell.</p> <p>### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).</p> https://cve.radiocsirt.org/vuln/ghsa-qxwq-q265-hc44