NocoDB Stored Cross-Site Scripting Vulnerability in Comments and Rich Text Cells

A stored cross-site scripting vulnerability has been identified in NocoDB versions prior to 0.301.3. User-controlled content in comments and rich text cells was rendered using v-html without proper sanitization, allowing for the execution of malicious scripts. This issue was present in comments managed by the Commenter role and in rich text cells accessible to users with the Editor role.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of users viewing the affected comments or rich text cells.

Remediation

Users can upgrade to NocoDB version 0.301.3 to address this vulnerability.