CVE-2026-28357

描述

### Summary A stored XSS vulnerability exists in the Formula virtual cell. Formula results containing `URI::()` patterns are rendered via `v-html` without sanitization, allowing injected HTML to execute. ### Details The `replaceUrlsWithLink()` function in `urlUtils.ts` converts `URI::(url)` patterns to `<a>` tags but passes all other HTML through unchanged. A user with Creator role (minimum role for formula field creation) can craft a formula like `CONCAT("URI::(https://example.com)", "<img src=x onerror=...>")` to inject arbitrary scripts rendered for all viewers. ### Impact Credential theft via script execution in the context of users viewing the table. ### Credit This issue was reported by [@Akokonunes](https://github.com/Akokonunes).

受影響套件(1)

• npm/nocodbfrom 0, < 0.301.3

CVSS 分數

參考連結(4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-28357
• PATCHhttps://github.com/nocodb/nocodb
• WEBhttps://github.com/nocodb/nocodb/releases/tag/0.301.3
• WEBhttps://github.com/nocodb/nocodb/security/advisories/GHSA-vx5p-q85x-xm3c