A vulnerability, which was classified as problematic, was found in NocoDB up to 0.301.2. The affected element is an unknown function of the component v-html. The manipulation results in HTML injection.
This vulnerability is known as CVE-2026-28401. It is possible to launch the attack remotely. No exploit is available.
You should upgrade the affected component.
