CVE-2026-84701

5.1 mediumEPSS 0.3%

Medium (5.1). EPSS 0.3% chance of exploitation in the next 30 days.

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-09-02
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

References

https://github.com/nocobase/nocobase
https://github.com/nocobase/nocobase/blob/v2.2.5/packages/core/client/src/schema-component/antd/input/ReadPretty.tsx
https://github.com/nocobase/nocobase/issues/10416
https://www.vulncheck.com/advisories/nocobase-rich-text-field-stored-cross-site-scripting-via-api

Check your stack JSON