CVE-2026-84701
Received Received - Intake

Stored XSS in NocoBase Rich Text Renderer

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84701
EUVD
EUVD-2026-69792

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nocobase nocobase to 2.2.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NocoBase has a stored Cross-Site Scripting (XSS) vulnerability in its rich text field read renderer. Users with create permissions can inject malicious HTML containing event handlers via the collection API. When other users view the affected record, the malicious payload executes in their browsers.

Detection Guidance

Check NocoBase versions for 2.2.5 or earlier. Inspect rich text fields in records for unexpected HTML tags or event handlers like onerror, onload, or onclick. Monitor network traffic for suspicious API requests to collection endpoints containing rich text fields.

Impact Analysis

An attacker with member-level permissions could steal session tokens or take over accounts of users viewing the compromised record. Malicious JavaScript could execute actions on behalf of users, potentially leading to data theft or unauthorized changes.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade NocoBase to the latest version. Implement server-side HTML sanitization for rich text fields using libraries like sanitize-html. Restrict user permissions to prevent unauthorized API writes. Review and sanitize existing rich text field data in the database.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart