Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-4R4F-GG25-RMG5

    Vulnerability from github – Published: 2026-07-17 18:35 – Updated: 2026-07-17 18:35
    VLAI
    Summary
    plone.app.textfield: Stored XSS by spoofing mime type
    Details

    Impact

    A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (text/x-html-safe) is the type that signifies "already sanitized", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips on* event-handler attributes and javascript:/data: URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via tal:content="structure ...", which performs no escaping, so the payload executes in the viewer's browser.

    This can be a problem when a RichText field is wrongly defined in code with a mimeType and outputMimeType that are the same, or when the REST API is used to the same effect.

    Patches

    The problem has been patched:

    • For Plone 6.0, upgrade plone.app.textfield to 2.0.2.
    • For Plone 6.1, upgrade plone.app.textfield to 3.0.2.
    • For Plone 6.2, upgrade plone.app.textfield to 4.0.1.

    Workarounds

    There is no known workaround.

    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone.app.textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54503"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T18:35:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound \u2014 it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer\u0027s browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0, upgrade `plone.app.textfield` to 2.0.2.\n* For Plone 6.1, upgrade `plone.app.textfield` to 3.0.2.\n* For Plone 6.2, upgrade `plone.app.textfield` to 4.0.1.\n\n### Workarounds\nThere is no known workaround.",
  "id": "GHSA-4r4f-gg25-rmg5",
  "modified": "2026-07-17T18:35:57Z",
  "published": "2026-07-17T18:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plone/plone.app.textfield"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "plone.app.textfield: Stored XSS by spoofing mime type "
}

    PYSEC-2026-3497

    Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:32
    VLAI
    Details

    Impact

    A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (text/x-html-safe) is the type that signifies "already sanitized", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips on* event-handler attributes and javascript:/data: URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via tal:content="structure ...", which performs no escaping, so the payload executes in the viewer's browser.

    This can be a problem when a RichText field is wrongly defined in code with a mimeType and outputMimeType that are the same, or when the REST API is used to the same effect.

    Patches

    The problem has been patched:

    • For Plone 6.0, upgrade plone.app.textfield to 2.0.2.
    • For Plone 6.1, upgrade plone.app.textfield to 3.0.2.
    • For Plone 6.2, upgrade plone.app.textfield to 4.0.1.

    Workarounds

    There is no known workaround.

    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    Impacted products
    Name purl
    plone-app-textfield pkg:pypi/plone-app-textfield
    Aliases
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "plone-app-textfield",
        "purl": "pkg:pypi/plone-app-textfield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.2"
            },
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.2"
            },
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0",
        "1.0.1",
        "1.0.2",
        "1.0b1",
        "1.0b2",
        "1.0b3",
        "1.0b4",
        "1.0b5",
        "1.0b6",
        "1.0b7",
        "1.1",
        "1.2",
        "1.2.1",
        "1.2.10",
        "1.2.11",
        "1.2.12",
        "1.2.2",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8",
        "1.2.9",
        "1.3.0",
        "1.3.1",
        "1.3.2",
        "1.3.3",
        "1.3.4",
        "1.3.5",
        "1.3.6",
        "1.3.7",
        "2.0.0",
        "2.0.1",
        "3.0.0",
        "3.0.1",
        "4.0.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54503",
    "GHSA-4r4f-gg25-rmg5"
  ],
  "details": "### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound \u2014 it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer\u0027s browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0, upgrade `plone.app.textfield` to 2.0.2.\n* For Plone 6.1, upgrade `plone.app.textfield` to 3.0.2.\n* For Plone 6.2, upgrade `plone.app.textfield` to 4.0.1.\n\n### Workarounds\nThere is no known workaround.",
  "id": "PYSEC-2026-3497",
  "modified": "2026-07-23T14:32:25.443333Z",
  "published": "2026-07-23T11:41:46.855463Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plone/plone.app.textfield"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/plone-app-textfield"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4r4f-gg25-rmg5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54503"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "plone.app.textfield: Stored XSS by spoofing mime type "
}