The vulnerability allows attackers to embed malicious JavaScript into comments that are rendered via v-html without any sanitization. This stored cross‑site scripting can execute arbitrary code in the browser context of any user who views the comment, potentially leading to session hijacking, data exfiltration, or defacement of the application. The weakness aligns with the Common Weakness Enumeration CWE‑79, a client‑side XSS flaw.

NocoDB installations running versions prior to 0.301.3 are affected. The vulnerability has been patched in release 0.301.3 and later. All earlier releases that include the comment feature are susceptible.

The CVSS score of 5.3 indicates a moderate severity impact, while the EPSS score of less than 1% suggests a very low probability of public exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be local via the comment interface; an attacker can inject a payload that will be executed when any user views the comment. This inference is based on the description and is not explicitly stated in the CVE data. The attack appears relatively simple to execute but relies on the availability of the comment feature and may require authenticated access to add the malicious comment.