CVE-2026-76837
Received Received - Intake

Stored XSS in Baserow User Display Name

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76837
EUVD
EUVD-2026-65009

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
baserow baserow to 2.3.0 (inc)
baserow baserow 2.2.2
baserow baserow to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Baserow versions before 2.3.0. It occurs because user display names are inserted into rich-text mention markup without proper HTML encoding. A malicious user can set their display name to include a double quote and script code, which closes HTML attributes and injects executable markup. When other users view a table mentioning this user, the script executes automatically via the v-html directive, affecting all workspace members regardless of permissions.

Detection Guidance

Check Baserow version with: curl -s http://your-basero-url/api/version/ | grep version. If version is before 2.3.0, the system is vulnerable. Inspect web-frontend/modules/core/editor/mention.js for template literal usage without HTML escaping.

Impact Analysis

An attacker with low-level workspace access can inject malicious scripts into their display name. When other users view any rich-text cell mentioning them, the script runs in their browser without requiring interaction. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the victim. The payload persists until the attacker changes their name or the mentioning row is removed.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to sensitive data through script execution. GDPR requires protecting personal data from unauthorized access or disclosure, while HIPAA mandates safeguards against data breaches. A successful exploit could lead to data exposure, compromising compliance. Baserow claims GDPR, HIPAA, and SOC 2 Type II compliance, but this flaw undermines those assurances.

Mitigation Strategies

Upgrade Baserow to version 2.3.0 or later immediately. If upgrading is not possible, disable rich-text mention features or restrict user display name changes to prevent malicious name injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76837. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart