CVE-2026-76837 - Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name
Brief
CVE ID : CVE-2026-76837
Published : Aug. 24, 2026, 6:17 p. m.
- 54 minutes ago
Description : Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention. js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped.
A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click.