NocoDB Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in NocoDB versions prior to 0.301.3. The issue arises because comments were rendered using v-html without proper sanitization, allowing users to inject malicious scripts. This vulnerability affects users with the Commenter role, as injected scripts are executed for all viewers of the comment.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the comment.

Remediation

Users can upgrade to NocoDB version 0.301.3 or later to address this vulnerability.