CVE-2026-76837: Baserow Rich-Text Mention XSS Vulnerability

CVE-2026-76837 Overview

CVE-2026-76837 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Baserow, an open-source no-code database platform. The flaw resides in the rich-text mention renderer, which interpolates a user's first_name display name into HTML markup without encoding. Any workspace member at the lowest permission level can set a malicious display name through PATCH /api/user/account/. When another workspace member views a table cell that mentions the attacker's account, the injected script executes automatically without user interaction. The payload persists until the name is changed or the mentioning row is removed. Baserow version 2.3.0 escapes the value before interpolation.

Critical Impact
Low-privileged workspace members can achieve stored XSS against every other workspace member viewing rich-text cells that mention the malicious account, with no click required.

Affected Products

Baserow versions prior to 2.3.0
Baserow rich-text field components rendering mentions via v-html
Baserow web-frontend module web-frontend/modules/core/editor/mention.js

Discovery Timeline

2026-08-24 - CVE-2026-76837 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76837

Vulnerability Analysis

The vulnerability originates in Baserow's rich-text editor mention system. The endpoint PATCH /api/user/account/ stores the first_name value verbatim without input sanitization. When the frontend renders a mention, mention.js builds the DOM element using a JavaScript template literal that inserts the raw name into a data-label attribute and into the element body.

Because the rich-text field components render the resulting string through Vue.js v-html, browser HTML parsing executes any injected markup. A name containing a double quote character terminates the data-label attribute and the opening tag, causing subsequent characters to be parsed as element content. Attackers can inject <img>, <svg>, or other tags with event handlers that execute arbitrary JavaScript in the victim's authenticated session.

Root Cause

The root cause is missing output encoding of user-controlled text before HTML interpolation. The parseMention function in web-frontend/modules/core/editor/mention.js concatenated the user's display name directly into a raw HTML string that was later rendered via v-html, bypassing Vue's default template escaping.

Attack Vector

A low-privileged workspace member updates their account to set a first_name containing an HTML-breaking payload. The attacker then mentions themselves in a rich-text cell within a shared table. Every workspace member who loads that table triggers the stored script, enabling session theft, CSRF against Baserow APIs, or lateral pivoting inside the workspace.

javascript

// Security patch from Baserow commit a870dc0d38c9
// web-frontend/modules/core/editor/mention.js

const USER_ID_REGEXP = /@(\d+)/

// Escape user-controlled text before it's interpolated into the raw HTML
// string below, which is rendered with v-html. Without this, a malicious
// display name could inject markup and execute a stored XSS.
const escapeHtml = (value) =>
  String(value)
    .replace(/&/g, '&')
    .replace(/</g, '<')
    .replace(/>/g, '>')
    .replace(/"/g, '"')
    .replace(/'/g, ''')

export const parseMention = (users, loggedUserId = null) =>
  regexp(USER_ID_REGEXP, (match, utils) => {
    const user = users.find((user) => user.user_id === parseInt(match[1]))

Source: Baserow Commit a870dc0

Detection Methods for CVE-2026-76837

Indicators of Compromise

User accounts whose first_name field contains characters such as ", <, >, or HTML tag fragments like <img, <svg, or onerror=.
Anomalous PATCH /api/user/account/ requests with first_name payloads exceeding typical name length or containing script-like tokens.
Rich-text cell contents referencing @<user_id> mentions where the referenced user's display name contains markup.

Detection Strategies

Query the Baserow user database for any first_name values matching a regex such as [<>"']|on[a-z]+= and review affected accounts.
Inspect web application firewall (WAF) or reverse proxy logs for PATCH /api/user/account/ requests carrying HTML metacharacters in JSON bodies.
Correlate browser console errors or Content Security Policy (CSP) violation reports originating from Baserow rich-text views.

Monitoring Recommendations

Alert on modifications to the first_name attribute that introduce non-alphanumeric characters outside a permitted set.
Log and review all rich-text field edits that insert @ mentions across shared tables.
Enable CSP reporting endpoints on the Baserow frontend to capture blocked inline script executions.

How to Mitigate CVE-2026-76837

Immediate Actions Required

Upgrade Baserow to version 2.3.0 or later, which applies HTML escaping in parseMention.
Audit all existing user first_name values and reset any containing HTML metacharacters.
Review recent rich-text cell content for embedded mention markup that may have executed stored payloads.

Patch Information

The fix is delivered in Baserow commit a870dc0d38c9 and merged via Baserow Pull Request #5618. The patch introduces an escapeHtml helper that encodes &, <, >, ", and ' before the value is interpolated into the v-html template. See the VulnCheck Advisory for Baserow for advisory details.

Workarounds

Restrict workspace invitations to trusted users until the upgrade is deployed.
Enforce a strict Content Security Policy that disallows inline event handlers and unsafe-inline script sources on the Baserow frontend.
Add reverse-proxy input validation on PATCH /api/user/account/ to reject first_name values containing HTML metacharacters.

bash

# Example nginx location block enforcing stricter Content-Security-Policy on Baserow
location / {
    proxy_pass http://baserow_upstream;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
}