Description

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-24T18:17:21.887Z",
  "pubdate": "2026-08-24T18:17:21.887Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists in Baserow, specifically affecting user account management and rich-text rendering components. The flaw allows low-privileged workspace members to inject arbitrary JavaScript payloads via the first_name parameter, which are persistently stored and later executed within the context of other users viewing the data. The vulnerability impacts Baserow prior to version 2.3.0.\nThe risk implication is severe, as successful exploitation enables arbitrary script execution in the browsers of all workspace members who view a table containing a mention of the attacker. This requires no user interaction beyond viewing the affected rich-text cell. An attacker requires only the lowest workspace permission level to set the malicious display name and reach every other member of the workspace. The malicious payload persists persistently until the display name is modified or the mentioning row is deleted, leading to potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of victimized users within the platform.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper HTML encoding when interpolating user-supplied display names into rich-text mention markup. Specifically, the PATCH /api/user/account/ endpoint accepts and stores the first_name value verbatim without sanitization. The vulnerable component is the mention renderer located in web-frontend/modules/core/editor/mention.js, which constructs mention DOM elements using template literals. This implementation places the unescaped name directly into a data-label attribute and the body of the element.\nExploitation occurs when an attacker crafts a malicious first_name value containing a double quote character. This injected quote prematurely closes the data-label attribute and the opening HTML tag, allowing subsequent arbitrary HTML and JavaScript markup to be injected into the element content. Because the resulting output is subsequently rendered through v-html within the rich-text field components, the browser interprets the injected markup as executable code.\nThe attack flow proceeds as follows: First, the attacker authenticates to Baserow with the lowest workspace permission level. Second, the attacker sends a request to PATCH /api/user/account/ updating their first_name with a payload designed to break out of the HTML attribute and tag structure. Third, the attacker or any other workspace member creates a rich-text field and mentions the attacker's account. Fourth, when any workspace member views the table containing this mention, the frontend renders the unescaped markup via v-html. Fifth, the stored script executes automatically in the browser of every viewing member without requiring any explicit click or interaction. The payload remains active and executes repeatedly until the attacker changes their first_name or the mentioning row is removed. Affected versions include all versions prior to version 2.3.0, which resolves the issue by properly escaping the value prior to interpolation."
}