CVE-2023-49781 is a high severity (CVSS 7.3) stored cross-site scripting flaw in NocoDB, in the formula virtual cell display. Content outside a URI pattern is rendered unchanged as HTML in a viewer's browser. The fix is NocoDB 0.202.9, so upgrade any older instance.
What's affected
The record says versions prior to 0.202.9 are affected. The GitHub advisory GHSA-h6r4-xvw6-jc5h lists the nc-gui package as affected before 0.202.8 and patched in 0.202.9. The two statements differ slightly at the edge, so treat anything below 0.202.9 as vulnerable.
The weakness is CWE-79 (cross-site scripting). The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N: network reachable, a low privilege account, and a victim who must view the content. Both the record and the advisory rate it High at 7.3.
The cause is in the Formula.vue component. It renders a value with Vue's v-html, and a helper turns a special URI pattern into a link but leaves all other text unchanged. Fixed version: 0.202.9. The advisory lists no workarounds.
How to check if you're exposed
Find your NocoDB version in the application's About or version information, or check the container tag.
docker ps --format "{{.Image}}" | grep -i nocodb
If you build NocoDB into a package set, look at the nocodb or nc-gui entry in your lockfile. Any version below 0.202.9 needs an upgrade. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every NocoDB instance, including ones teams run for internal tools.
- Upgrade to 0.202.9 or later and restart the service.
- Review who can edit formula fields and cell content, and limit that to people who need it.
- Look for formula cell content you do not recognize, especially text containing HTML tags.
- Put a content security policy in front of the app if your proxy supports one.
Why it matters
Stored cross-site scripting means attacker controlled text is saved by the app and later rendered as active markup in another user's browser. The viewer's session then runs with that user's rights. In a database tool, that can expose tables and let the script act as the viewer.
The cause is a familiar one: output that should be escaped is passed through a raw HTML sink. The fix is to encode untrusted text before rendering. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which NocoDB version fixes this?
0.202.9, per the advisory and the CVE record.
Does the attacker need an account?
The vector shows a low privilege account and a victim who views the stored content.
Sources
Last reviewed: 19 October 2026.
