NocoDB’s rich‑text cells were rendered using Vue.js’ v‑html directive without any input sanitization, allowing an attacker to store malicious scripts that execute in the browser of any user who views the affected cell. The vulnerability can be used to steal authentication tokens, deface content, or perform session hijacking by leveraging a client‑side exploit that does not require elevated server privileges. The weakness is a classic input validation fault (CWE‑79).

The flaw affects all NocoDB installations running versions earlier than 0.301.3. The patch that disables unsanitized rendering was introduced in release 0.301.3. Any deployment that has not yet migrated to this or later versions remains vulnerable.

The CVSS score of 5.3 indicates a moderate impact from the data‑broad perspective. The EPSS score is less than 1 percent, suggesting a very low exploitation probability at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog, further indicating that widespread exploitation has not been observed. Attackers are likely to target users who can edit rich‑text cells, making the exploitation vector an interactive attack where the attacker gains editing permissions or convinces a user with those permissions to insert malicious content.