CyberRota Analysis
AI-GeneratedNocoBase is vulnerable due to inadequate sanitization of rich text field values, enabling users with create permissions to inject malicious HTML containing event handlers. This flaw allows attackers to execute arbitrary markup in the browsers of all users accessing the affected records, potentially leading to cross-site scripting (XSS) attacks. Organizations using NocoBase should prioritize addressing this vulnerability to mitigate risks associated with user-generated content and protect their user base.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record.