What’s Vulnerable › Vulnerabilities

CVE-2026-84701: NocoBase Rich Text Field Stored Cross-Site Scripting via API

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-16
• Weakness: CWE-79

Description

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

Affected products

• nocobase: through 2.2.5

References

• https://github.com/nocobase/nocobase
• https://github.com/nocobase/nocobase/blob/v2.2.5/packages/core/client/src/schema-component/antd/input/ReadPretty.tsx
• https://github.com/nocobase/nocobase/issues/10416
• https://www.vulncheck.com/advisories/nocobase-rich-text-field-stored-cross-site-scripting-via-api

Get alerted when CVE-2026-84701 or the next vulnerability affects your stack