NocoDB previously allowed user‑controlled comments and rich text cells to be rendered with Vue's v-html directive without sanitization. An attacker who can create or modify content in these fields can embed JavaScript that will execute in the browsers of any user who views the affected record, enabling session hijacking, data exfiltration, or UI defacement. The flaw is a typical stored XSS vulnerability as identified by CWE‑79.

The vulnerability applies to the NocoDB platform from any version before 0.301.3. The affected product is identified as "NocoDB"; all earlier releases are vulnerable once a user can add or edit comments or rich text cells. The issue was addressed in release 0.301.3, so any instance running 0.301.3 or later is no longer susceptible.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, which further implies that no known large‑scale attacks are currently associated with it. Attackers would need access to the NocoDB UI to inject malicious content, making the attack vector local or requiring compromised user credentials. Overall, the risk is moderate, but the exploitation likelihood remains low under normal circumstances.