CVE-2026-76837 in Baserow
Summary
by MITRE • 08/24/2026
Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in Baserow represents a critical stored cross-site scripting flaw rooted in improper input validation and output encoding within the user account management interface. The core technical deficiency lies in how the application handles the first_name field during PATCH requests to the /api/user/account/ endpoint, where the value is accepted and stored verbatim without any sanitization or HTML entity encoding. This lack of server-side filtering allows an attacker to inject arbitrary markup directly into the database records associated with a user profile. The vulnerability manifests further in the client-side rendering logic located within the web-frontend/modules/core/editor/mention.js module, which constructs rich-text mention elements using template literals that fail to escape special characters when populating both the data-label attribute and the element body. This combination of unescaped storage and unescaped DOM insertion creates a persistent attack vector where malicious scripts are embedded directly into the application's content structure rather than being treated as plain text.
The operational impact of this vulnerability is severe due to its stored nature, meaning that once an attacker sets their display name to include a crafted payload such as a double quote followed by closing tags and script injection code, every subsequent interaction with rich-text fields containing mentions of that user will trigger the execution of malicious JavaScript in the browsers of all workspace members who view those tables. Because the rendering is handled through v-html directives within Vue.js components, which bypasses Angular-style automatic escaping and directly injects HTML into the DOM, there are no built-in safeguards to prevent script execution. This allows for a non-click-based exploitation scenario where any user with at least basic read permissions can inadvertently execute code simply by viewing data containing references to the compromised account. The persistence of this threat is significant as the payload remains active until either the attacker manually changes their name or an administrator removes the specific row that contains the mention, making it difficult for users to detect and mitigate without auditing all stored mentions.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS), specifically in its stored variant where malicious scripts are permanently stored on the target server. The attack vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, particularly JavaScript execution within a browser environment, allowing for potential session hijacking, credential theft via keylogging or cookie stealing, and defacement of user interfaces. The low barrier to entry is notable since any workspace member can exploit this regardless of their administrative privileges, provided they have permission to edit rich-text fields that might reference other users. Mitigation strategies must focus on implementing strict output encoding at the point of rendering rather than relying solely on input validation. Developers should ensure that all dynamic content inserted into HTML attributes and element bodies is properly escaped using context-aware encoders such as those provided by OWASP ESAPI or framework-specific sanitization libraries like DOMPurify when dealing with v-html bindings. Additionally, updating to version 2.3.0 resolves this issue by introducing proper escaping mechanisms before interpolation occurs in the mention renderer, thereby neutralizing the ability of special characters to break out of their intended context and execute arbitrary code within the user's browser session.