Description

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T01:17:25.287Z",
  "pubdate": "2026-09-02T01:17:25.287Z",
  "executiveSummary": "NocoBase contains a critical stored Cross-Site Scripting (XSS) vulnerability within its rich text field rendering component.\nThe vulnerability arises from the failure to properly sanitize user-supplied HTML input before it is processed and rendered in the browser of other users.\nAn attacker possessing 'create' permissions on a collection can inject malicious markup, including JavaScript event handlers, directly into the database via the collection API.\nWhen a victim views the affected record, the malicious payload executes within the security context of the victim's session, potentially leading to unauthorized actions, session hijacking, or the exfiltration of sensitive data.\nThis vulnerability poses a significant risk to the integrity and confidentiality of the application, as it allows for persistent, cross-user impact without requiring direct interaction beyond the viewing of legitimate records.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of input during the rendering phase of the rich text field component in NocoBase. While the system allows users with specific create permissions to input rich text content, the read renderer fails to employ an effective allow-list-based sanitization library or strict output encoding before injecting the stored content into the Document Object Model (DOM).\nThe attack flow begins when an authenticated user with sufficient privileges interacts with the collection API to submit a record containing a malicious payload. Because the backend does not validate or sanitize the rich text input upon ingestion, the payload is stored persistently in the database. A typical injection vector involves embedding event handlers—such as 'onmouseover', 'onerror', or 'onload'—within HTML elements like '<img>', '<iframe>', or '<a>'. For example, an attacker could craft an input string like '<img src=x onerror=alert(document.cookie)>'.\nUpon saving, the payload remains dormant until a victim—which could include administrative users—navigates to the page where the affected record is displayed. The application's read renderer then fetches the unsanitized HTML from the database and inserts it directly into the page's HTML structure. The browser, trusting the application-provided markup, executes the embedded JavaScript event handlers.\nBecause the execution occurs within the context of the victim's session, the attacker gains the ability to perform any action the victim is authorized to perform within NocoBase. This includes, but is not limited to, modifying sensitive records, altering configuration settings, or stealing session tokens and cookies. Given the nature of Stored XSS, the payload affects all users viewing the compromised content, effectively facilitating lateral movement and privilege escalation scenarios if an administrator views the content. The vulnerability is characterized by its persistent nature, requiring no further interaction from the attacker after the initial injection, provided the victim accesses the target content."
}