Executive brief
NocoBase is an open-source no-code platform for building business applications. A vulnerability in how rich text fields are displayed allows users with create permissions to inject malicious HTML with JavaScript event handlers. When other users view affected records, the injected code executes in their browsers, potentially enabling account hijacking, data theft, or session manipulation.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the rich text field renderer (ReadPretty.tsx component). The root cause is insufficient HTML sanitization in the read renderer when displaying user-supplied rich text content. An attacker with create permissions can inject arbitrary HTML markup including event handlers via the collection API. The malicious payload is stored in the database and executed when any user views the affected record in their browser. No authentication bypass is required beyond the initial create permission. Patches are expected in subsequent releases addressing input validation on the collection API side and output encoding in the renderer.
Affected products
- NocoBase NocoBase 2.2.5 and earlier
Timeline
- 2026-09-02: disclosed
- 2026-09-02: advisory: CVE-2026-84701 published