Baserow prior 2.3.0 Renderer mention.js first_name cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Baserow prior 2.3.0. This affects an unknown part of the file web-frontend/modules/core/editor/mention.js of the component Renderer. The manipulation of the argument first_name leads to cross site scripting. This vulnerability is documented as CVE-2026-76837. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Baserow prior 2.3.0 and classified as problematic. This issue affects some unknown functionality of the file web-frontend/modules/core/editor/mention.js of the component Renderer. The manipulation of the argument first_name with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-76837 since 08/19/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-65009). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Baserow

Version

• <2.3.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion