Executive brief
Baserow is an open-source no-code database platform. A user's display name is rendered directly into rich-text mention elements without HTML encoding, allowing any workspace member to inject malicious JavaScript. This stored script executes automatically for all other members viewing that row, without requiring a click, and persists until the user's name is changed or the row is deleted. An attacker needs only basic workspace access to compromise all other members of the workspace.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the mention rendering logic. The web-frontend/modules/core/editor/mention.js file uses a template literal to construct mention markup, interpolating the user's display name (first_name field) into a data-label attribute and element body without HTML encoding. The PATCH /api/user/account/ endpoint stores the first_name value verbatim without sanitization. A display name containing a double quote can break out of the attribute and opening tag, injecting arbitrary markup. Since the resulting markup is rendered via v-html in rich-text field components, any injected script executes in the browser context of all workspace members viewing the table. Any workspace member, even at the lowest permission level, can modify their own display name and reach all other members in the workspace. The vulnerability was patched in version 2.3.0, which escapes the value before interpolation.
Affected products
- Baserow Baserow before 2.3.0
Timeline
- 2026-08-24: disclosed