---
id: CVE-2026-84701
title: >-
  NocoBase fails to sanitize rich text field values in the read renderer,
  allowing users with create permissions to store malicious HTML with event
  handlers
summary: >-
  NocoBase fails to sanitize rich text field values in the read renderer,
  allowing users with create permissions to store malicious HTML with event
  handlers. Attackers can write arbitrary markup through the collection API that
  executes in …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-09-02'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:44.563'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84701'
references:
  - url: 'https://github.com/nocobase/nocobase'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/nocobase/nocobase/blob/v2.2.5/packages/core/client/src/schema-component/antd/input/ReadPretty.tsx
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nocobase/nocobase/issues/10416'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nocobase-rich-text-field-stored-cross-site-scripting-via-api
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00298
epssPercentile: 0.20001
ingestedAt: '2026-09-16T13:56:12.600Z'
---

## Overview

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.