CVE-2023-49781
Description
NocoDB is software for building databases as spreadsheets. Prior to 0.202.9, a stored cross-site scripting vulnerability exists within the Formula virtual cell comments functionality. The nc-gui/components/virtual-cell/Formula.vue displays a v-html tag with the value of "urls" whose contents are processed by the function replaceUrlsWithLink(). This function recognizes the pattern URI::(XXX) and creates a hyperlink tag <a> with href=XXX. However, it leaves all the other contents outside of the pattern URI::(XXX) unchanged. This vulnerability is fixed in 0.202.9.
How to fix
- nocodb nocodb0.202.9 or later
- nocodb0.202.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nocodb nocodb | v < 0.202.9 | 0.202.9 |
| nocodbnpm | v < 0.202.9 | 0.202.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.