CVE-2026-84701 Overview
CVE-2026-84701 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in NocoBase, an open-source no-code development platform. The application fails to sanitize rich text field values in the read renderer. Users with create permissions can submit HTML containing event handlers through the collection API. When any other user views the affected record, the injected markup executes in their browser context.
The flaw resides in the ReadPretty.tsx component, which renders stored rich text without adequate output encoding. Because the payload persists in the database, every subsequent viewer of the record is exposed to the attacker-controlled script.
Critical Impact
Authenticated attackers can persist arbitrary JavaScript that executes in the browsers of all users viewing the affected record, enabling session theft, credential harvesting, and actions performed on behalf of higher-privileged users.
Affected Products
- NocoBase (open-source no-code platform)
- NocoBase client package @nocobase/client through version 2.2.5
- Deployments exposing rich text fields to authenticated users with create permissions
Discovery Timeline
- 2026-09-02 - CVE-2026-84701 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84701
Vulnerability Analysis
The vulnerability is a stored XSS [CWE-79] affecting the rich text field type in NocoBase. The rendering path in packages/core/client/src/schema-component/antd/input/ReadPretty.tsx writes user-supplied field content into the DOM without stripping active markup. Any HTML element that supports event handler attributes, such as onerror, onmouseover, or onload, will trigger JavaScript execution when the record is displayed.
Exploitation requires a low-privilege authenticated account with permission to create or update records containing a rich text field. The attacker submits a crafted payload through the standard collection REST API. The server stores the payload verbatim. When a second user, including administrators, opens the record view, the browser parses the injected markup and runs the attacker's script in the origin of the NocoBase application.
Because execution occurs in the victim's authenticated session, an attacker can exfiltrate session tokens, issue authenticated API calls, modify collections, or pivot to escalate privileges. User interaction is limited to viewing the affected record.
Root Cause
The root cause is missing output sanitization in the read-mode renderer for rich text fields. The component treats stored field values as trusted HTML and injects them directly into the rendered view. There is no allowlist of safe tags or attributes, and no removal of inline event handler attributes before rendering.
Attack Vector
The attack vector is network-based and authenticated. An attacker with a create-permission role posts a malicious HTML payload to the collection API endpoint that backs a rich text field. Any user, including higher-privileged users, who later views the record triggers execution of the stored script.
See the Vulncheck advisory for NocoBase and the ReadPretty component source for the affected code path. Tracking is available in GitHub Issue #10416.
Detection Methods for CVE-2026-84701
Indicators of Compromise
- Rich text field values in the collection database that contain <script> tags, javascript: URIs, or inline event handler attributes such as onerror=, onload=, onmouseover=, or onfocus=.
- Outbound requests from browsers of authenticated NocoBase users to unfamiliar external hosts shortly after opening a record.
- Unexpected authenticated API activity originating from administrator sessions after viewing user-created records.
Detection Strategies
- Query the underlying database for rich text columns and match values against a regular expression covering HTML tags and on\w+= attribute patterns.
- Enable a Content Security Policy (CSP) in report-only mode to log inline script violations from the NocoBase origin.
- Review web server access logs for POST and PATCH requests to /api/* collection endpoints containing raw HTML payloads with event handlers.
Monitoring Recommendations
- Alert on browser CSP violation reports referencing inline event handlers on NocoBase pages.
- Monitor authenticated API traffic for anomalous request volumes originating from a single session after record views.
- Audit role assignments so that only trusted principals hold create permissions on collections containing rich text fields.
How to Mitigate CVE-2026-84701
Immediate Actions Required
- Upgrade NocoBase to a release that patches the ReadPretty rich text renderer once the maintainers publish a fixed version. Track the NocoBase GitHub repository for advisories.
- Restrict create and update permissions on collections containing rich text fields to trusted roles only.
- Deploy a strict Content Security Policy that blocks inline scripts and inline event handlers on the NocoBase origin.
Patch Information
As of the NVD publication date, no fixed version is referenced in the CVE record. Consult the Vulncheck advisory and GitHub Issue #10416 for status updates from the NocoBase maintainers. Affected code is present in @nocobase/client version 2.2.5.
Workarounds
- Replace rich text fields with plain text fields on collections that accept input from low-privilege users until a patch is available.
- Introduce a server-side sanitization layer, such as DOMPurify, that strips event handler attributes and script tags from rich text values before persistence.
- Sanitize existing stored values by scanning the database and removing HTML that contains on\w+= attributes or <script> tags.
- Enforce a Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self' to prevent execution of inline handlers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
