NocoDB allows users to create databases and interact with them through spreadsheet‑like interfaces. In versions prior to 0.301.3 an authenticated user who has an Editor role can bypass the built‑in TipTap editor and submit raw HTML directly to Rich Text cells via the API. This results in a stored Cross‑Site Scripting vulnerability, meaning the malicious script becomes part of the database record and will be rendered on any subsequent page that displays the cell content, potentially compromising the confidentiality, integrity, or availability of user sessions.

Affected product: NocoDB, all releases before 0.301.3. An authenticated user with Editor privileges can exploit the flaw. The issue is confined to the web application layer, with no specific operating system dependency.

The CVSS score of 5.3 places the vulnerability in the medium severity range, and the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. Although the flaw is not listed in the CISA KEV catalog, it can be leveraged by any user who has been granted Editor permissions. Attackers would need local authentication to the NocoDB instance; therefore, the attack vector is internal, but once authenticated users can inject persistent malicious content that will affect all users who view the affected Rich Text cells.