EUVD-2026-69792
GHSA-9mv7-8vhm-9hc5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API write requires low-privilege auth (PR:L); victim must view record (UI:R); stored XSS crosses user scope boundary (S:C); limited DOM/session impact (C:L/I:L).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.
AnalysisAI
Stored cross-site scripting in NocoBase's rich text field read renderer allows any authenticated user with record-creation permissions to inject persistent malicious HTML into the application's collection API, executing arbitrary JavaScript in the browsers of all users who subsequently view the affected record. The vulnerable component is the ReadPretty renderer (packages/core/client/src/schema-component/antd/input/ReadPretty.tsx), which fails to sanitize event handlers from stored rich text values before rendering them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold at minimum create (write) permissions on a NocoBase collection that exposes a rich text field type. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 reflects a moderate-severity stored XSS - impact is bounded at VC:L/VI:L/SC:L/SI:L with no availability component, consistent with classic stored XSS limited to session/DOM-context access rather than direct system compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to NocoBase v2.2.5 or later, which patches the ReadPretty.tsx renderer to sanitize rich text field output before DOM insertion. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today