NocoDB Stored Cross-Site Scripting Vulnerability in Rich Text Cells

A stored cross-site scripting vulnerability has been identified in NocoDB versions prior to 0.301.3. The issue arises in rich text cells, where content is rendered using v-html without proper sanitization. This flaw allows users with Editor roles to inject arbitrary HTML, including malicious scripts, which are executed for all viewers of the cell.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the rich text cell.

Remediation

Users can upgrade to NocoDB version 0.301.3 or later to address this vulnerability.