Stored Cross-Site Scripting in NocoBase Affects User Input Handling
CVE-2026-84701

5.1MEDIUM

Key Information:

Vendor

Nocobase

Status
Nocobase
Vendor
CVE Published:
2 September 2026

What is CVE-2026-84701?

NocoBase contains a vulnerability in its rich text field handling, specifically within the read renderer. This allows users with create permissions to inject malicious HTML, including event handlers, into the application. By leveraging the collection API, attackers can craft arbitrary markup that executes within the browsers of users viewing the affected record, leading to potential security breaches. Proper sanitization of user inputs is crucial for preventing such attacks.

Affected Version(s)

nocobase 0 <= 2.2.5

References

https://github.com/nocobase/nocobase
product
https://github.com/nocobase/nocobase/issues/10416
issue-tracking
https://github.com/nocobase/nocobase/blob/v2.2.5/packages...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.