Stored Cross-Site Scripting in Baserow Web Application by Baserow

CVE-2026-76837

What is CVE-2026-76837?

Baserow has a vulnerability where it improperly interpolates user display names into rich-text mention markup without adequate HTML encoding. This allows an attacker to inject malicious scripts through a display name that gets stored and executed whenever other users view the rich text cell. The vulnerability persists in the context of each user's workspace, enabling accounts with minimal permissions to execute the script across the interface. Baserow version 2.3.0 addresses this issue by escaping the name value before rendering it.

References