CVE-2026-84701: NocoBase Rich Text Field Stored Cross-Site Scripting via API
Published Sep 2, 2026
·Updated
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.
Affected Software
1 affected component
NocoBase
Event History
Sep 2, 2026
CVE Published
via MITRE·12:37 AM
Data Sourced
via MITRE·12:37 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker needs create permissions for a collection with an affected rich text field. They can submit malicious markup through the collection API.
2
Who is exposed to the stored payload?
Any user whose browser renders a record containing the malicious rich text value is exposed. The payload executes when those users view the affected record.
3
Is victim interaction required for exploitation?
Yes. A target user must view a record that contains the attacker-controlled rich text content for the browser-side payload to execute.