CVE-2026-54503: plone.app.textfield XSS Vulnerability

CVE-2026-54503 Overview

CVE-2026-54503 is a stored cross-site scripting (XSS) vulnerability in plone.app.textfield, a component of the Plone content management system. The flaw resides in RichTextValue.output, which returns an unsanitized stored value when the field's mimeType equals its outputMimeType. This equality shortcut bypasses the safe_html transform, even when the declared output type is text/x-html-safe. Authenticated users who can set a RichText field can inject JavaScript that executes in a viewer's browser [CWE-80]. The issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.

Critical Impact
An authenticated user with permission to edit a RichText field can store malicious JavaScript that runs in the browser of any user viewing the affected content, enabling session theft or actions performed in the victim's context.

Affected Products

plone.app.textfield versions prior to 2.0.2 (2.x release line)
plone.app.textfield versions prior to 3.0.2 (3.x release line)
plone.app.textfield versions prior to 4.0.1 (4.x release line)

Discovery Timeline

2026-09-15 - CVE-2026-54503 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-54503

Vulnerability Analysis

The vulnerability is a stored XSS issue in the RichTextValue.output property of plone.app.textfield. Plone provides a zope.schema-style field called RichText that stores both a value and its associated MIME type. When rendering content, Plone normally routes values through a safe_html transform that strips event-handler attributes and unsafe URI schemes.

The transform itself is not defective. The defect lies in an optimization in RichTextValue.output: when the stored mimeType equals the configured outputMimeType, the code returns the raw stored value directly, skipping the transform. Templates then emit the value through tal:content=structure, which does not HTML-escape output. Any script the attacker stored is rendered verbatim to viewers.

Root Cause

The root cause is an unsafe fast path in the output pipeline. The equality check mimeType == outputMimeType treated matching types as inherently safe, but this assumption fails for the text/x-html-safe output type. That MIME type is a marker indicating the value must pass through sanitization, not a guarantee that the stored value is already sanitized. Skipping the transform therefore emits attacker-controlled markup unchanged.

Attack Vector

Two paths trigger the bypass. First, a RichText field can be configured with identical mimeType and outputMimeType, causing all writes to skip sanitization on read. Second, the REST API accepts input where the client supplies text/x-html-safe as the content type, which then matches the field's output type and bypasses the transform. An authenticated user with rights to set a RichText field stores a payload such as <script>...</script> or an element with an event handler; that payload executes in the browser of any user later viewing the content.

python

# Security patch in src/plone/app/textfield/value.py
# Introduces explicit MIME-type constants used to force sanitization
# of the text/x-html-safe output type regardless of equality shortcuts.

LOG = logging.getLogger("plone.app.textfield")

HTML_MIME_TYPE = "text/html"
SAFE_HTML_MIME_TYPE = "text/x-html-safe"


class RawValueHolder(Persistent):
    """Place the raw value in a separate persistent object so that it does not

Source: GitHub Commit 0da1aeec2406

Detection Methods for CVE-2026-54503

Indicators of Compromise

Stored RichText field values containing <script> tags, on* event-handler attributes, or javascript: URI schemes.
REST API POST or PATCH requests to Plone content endpoints that specify text/x-html-safe as the input content type.
RichText field schemas configured with identical mimeType and outputMimeType values.

Detection Strategies

Audit the Plone object database for RichText values whose raw content contains HTML tags or attributes that would normally be removed by the safe_html transform.
Review web server and application logs for anomalous content-type declarations on content-authoring endpoints, particularly text/x-html-safe submitted by non-privileged accounts.
Compare rendered page output against sanitized expectations in staging to identify fields returning unsanitized markup.

Monitoring Recommendations

Log and alert on edits to RichText fields by newly created or low-reputation authenticated accounts.
Track client-side errors and Content Security Policy (CSP) violation reports that reference inline scripts on Plone-rendered pages.
Monitor REST API traffic for unusual MIME types in request payloads targeting Plone content endpoints.

How to Mitigate CVE-2026-54503

Immediate Actions Required

Upgrade plone.app.textfield to 2.0.2, 3.0.2, or 4.0.1 depending on the release line in use.
Restrict RichText edit permissions to trusted users until patched versions are deployed.
Review existing RichText content for previously stored payloads and remediate affected records.

Patch Information

The fix always routes values through sanitization when the output type is text/x-html-safe, removing the equality shortcut that bypassed the transform. See the GitHub Security Advisory GHSA-4r4f-gg25-rmg5 and the corresponding commits: 0da1aeec2406, 467638e500d, and 781d517a3852.

Workarounds

Reconfigure RichText fields so that mimeType and outputMimeType are not identical, forcing traversal through the transform pipeline.
Reject or normalize REST API requests that declare text/x-html-safe as the input content type.
Deploy a strict Content Security Policy that blocks inline scripts on pages that render user-authored RichText content.

bash

# Upgrade plone.app.textfield to a patched release
pip install --upgrade 'plone.app.textfield>=4.0.1'

# Or pin an appropriate release line in constraints.txt
# plone.app.textfield==2.0.2
# plone.app.textfield==3.0.2
# plone.app.textfield==4.0.1