CVE-2026-84701

5.4 Moyenne

Publiée le 02/09/2026 à 03:17 · Modifiée le 16/09/2026 à 15:42 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

Traduire en français

Produits concernés

nocobase

Scores CVSS

Version	Score	Source	Vecteur
4.0	5.1 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.4 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/nocobase/nocobase
https://github.com/nocobase/nocobase/blob/v2.2.5/packages/core/client/src/schema-component/antd/input/ReadPretty.tsx
https://github.com/nocobase/nocobase/issues/10416
https://www.vulncheck.com/advisories/nocobase-rich-text-field-stored-cross-site-scripting-via-api

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories