NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event… (CVE-2026-84701)

NocoBase fails to sanitize rich text field values in its read renderer component. Users with create permissions can inject arbitrary HTML with event handlers through the collection API. This injected markup executes in the browsers of users viewing the affected records, enabling cross-site scripting (CWE-79). The CVSS 3.1 base score is 5.4 (medium severity) with network attack vector, low attack complexity, low privileges required, and requiring user interaction. The vulnerability impacts confidentiality and integrity but not availability. No patch or remediation information is provided in the source data.

Attackers with create permissions can inject malicious HTML that executes in other users' browsers when they view the affected records. This can lead to unauthorized actions performed in the context of the victim user, data theft, or session hijacking. The impact is limited to confidentiality and integrity, with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict create permissions to trusted users only and consider additional input validation or sanitization controls on rich text fields if possible.