CVE-2026-110239 in Rapyd Admin
Summary
by MITRE • 10/13/2026
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Rapyd Admin framework prior to version 9.20.0, specifically affecting the x-rpd::rich-text Blade component. This vulnerability is classified as a stored cross-site scripting issue, which represents a severe category of web application insecurity where malicious scripts are permanently embedded within target sites. The root cause lies in the improper handling of user-supplied input during the rendering process. When the framework processes data for display, it outputs bound model values directly into HTML structures without applying adequate sanitization or encoding mechanisms. This failure to validate and sanitize input allows attackers to inject executable JavaScript code that is subsequently stored on the server side rather than being executed immediately in a transient context.
The operational mechanism of this exploit relies heavily on the interaction with the Livewire client API, which facilitates dynamic updates to web pages without full page reloads. An authenticated user can leverage this API endpoint to manipulate the bound property associated with the rich-text component. By submitting crafted data through this interface, an attacker can inject malicious JavaScript payloads into the database or backend storage. Because the system treats these inputs as trusted content for rendering purposes, it fails to escape special characters that would normally prevent script execution. Consequently, when another user, particularly one with administrative privileges, accesses the record's form view, the browser interprets and executes the injected scripts within the context of the application’s domain.
The impact of this vulnerability is significant due to its stored nature and the privilege level often associated with administrators who are likely targets for such attacks. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim user's browser session. This capability can lead to a range of malicious activities, including but not limited to stealing sensitive administrative cookies or session tokens, performing actions on behalf of the administrator without their consent, defacing the application interface, or redirecting users to phishing sites. Since the payload is stored server-side, it persists until manually removed from the database, meaning every subsequent access by an authorized user triggers the malicious script execution, thereby amplifying the potential damage and scope of the compromise.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific variant here is stored XSS because the payload persists in memory or storage rather than being passed via URL parameters or form submissions that are processed and discarded. In terms of tactical mapping to the MITRE ATT&CK framework, this behavior corresponds to T1059.007, which covers JavaScript execution as a technique for command and control or credential access. The use of an authenticated API endpoint also highlights issues related to insufficient authorization checks if lower-privileged users were able to inject payloads that affect higher-privileged accounts, though the primary flaw is input validation failure rather than broken access control per se.
To mitigate this vulnerability, immediate action must be taken by upgrading the Rapyd Admin framework to version 9.20.0 or later, where these sanitization issues have been addressed in the x-rpd::rich-text component. For organizations unable to upgrade immediately, a temporary workaround involves implementing strict output encoding on all bound model values before they are rendered into HTML views. Developers should ensure that any data originating from user inputs is escaped using context-appropriate encodings such as HTML entity encoding for text content or JavaScript escaping if inserted into script blocks. Additionally, enforcing Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts can be loaded and executed. Regular security audits focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities in other components of the application stack.