CVE-2026-54503

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54503

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54503.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54503

Aliases

Published

2026-09-15T16:38:38Z

Modified

2026-09-17T03:47:29Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

plone.app.textfield: Stored XSS by spoofing mime type

Details

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54503.json"
}

References

Affected packages

Git / github.com/plone/plone.app.textfield

Affected ranges

Type

GIT

Repo

https://github.com/plone/plone.app.textfield

Events

Introduced

3f32e6b0376e9c0155205ecb9a28550c3b9204e1

Introduced

cf07102d2d99ba14b706224888d0341f558d0c2e

Fixed

c08d333f818afaaf34031de3925c6fab6cbaafb1

Fixed

0da2e11a5452366f172e95e8a1579bba2a4e2b53

Fixed

6f00dda28350463a90f1d3bf362810a59bcc3ade

Fixed

0da1aeec2406cf640977eb857a03e792d2c7cac2

Fixed

467638e500d804c637031387a227a2b02d12a86f

Fixed

781d517a38524087fe57525a94806684908f852f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.2"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.2"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0

1.0.1

1.0.2

1.0b6

1.0b7

1.1

1.2.10

1.2.11

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

2.*

2.0.0

2.0.1

3.*

3.0.0

3.0.1

4.*

4.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54503.json"