CVE-2026-54503 (GCVE-0-2026-54503)
Vulnerability from cvelistv5
Published
2026-09-15 16:38
Modified
2026-09-15 19:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Summary
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| plone | plone.app.textfield |
Version: < 2.0.2 Version: >= 3.0.0, < 3.0.2 Version: >= 4.0.0, < 4.0.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54503",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:02:07.172464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:02:18.109Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "plone.app.textfield",
"vendor": "plone",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.2"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.0.2"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T16:38:38.290Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"
},
{
"name": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2"
},
{
"name": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f"
},
{
"name": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f"
}
],
"source": {
"advisory": "GHSA-4r4f-gg25-rmg5",
"discovery": "UNKNOWN"
},
"title": "plone.app.textfield: Stored XSS by spoofing mime type"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54503",
"datePublished": "2026-09-15T16:38:38.290Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-09-15T19:02:18.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54503\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T19:02:07.172464Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T19:02:13.197Z\"}}], \"cna\": {\"title\": \"plone.app.textfield: Stored XSS by spoofing mime type\", \"source\": {\"advisory\": \"GHSA-4r4f-gg25-rmg5\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"plone\", \"product\": \"plone.app.textfield\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 3.0.0, \u003c 3.0.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.0.1\"}]}], \"references\": [{\"url\": \"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\", \"name\": \"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2\", \"name\": \"https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f\", \"name\": \"https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f\", \"name\": \"https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer\u0027s browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-80\", \"description\": \"CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-15T16:38:38.290Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-54503\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T19:02:18.109Z\", \"dateReserved\": \"2026-06-15T18:01:15.512Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-09-15T16:38:38.290Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…