CVE-2026-84701

MEDIUM 5.4

NocoBase Rich Text Field Stored Cross-Site Scripting via API

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

CWE	CWE-79
Vendor	nocobase
Product	nocobase
Published	Sep 2, 2026

Stay Ahead of the Next One

Get instant alerts for nocobase nocobase

Be the first to know when new medium vulnerabilities affecting nocobase nocobase are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

nocobase / nocobase

0 ≤ 2.2.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nocobase/nocobase github.com: https://github.com/nocobase/nocobase/issues/10416 github.com: https://github.com/nocobase/nocobase/blob/v2.2.5/packages/core/client/src/schema-component/antd/input/ReadPretty.tsx vulncheck.com: https://www.vulncheck.com/advisories/nocobase-rich-text-field-stored-cross-site-scripting-via-api

Credits

George Chen