NocoDB Stored Cross-Site Scripting Vulnerability in Formula Virtual Cell

A stored cross-site scripting (XSS) vulnerability has been identified in NocoDB versions prior to 0.301.3. The issue resides in the Formula virtual cell, where results containing 'URI::()' patterns are rendered using 'v-html' without proper sanitization. This oversight allows injected HTML to execute. A user with a Creator role can exploit this by crafting a formula that includes malicious scripts, which are then executed for all viewers of the table.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the execution of scripts in the context of the user viewing the table, potentially leading to credential theft.

Remediation

Users can upgrade to NocoDB version 0.301.3 or later to address this vulnerability.