CVE-2026-84701 nocobase CVE debrief

Who should care

Defenders responsible for NocoBase installations, security teams, and developers should assess exposure and prioritize patching and monitoring. They must verify and patch affected NocoBase installations to prevent exploitation, monitor for potential exploitation attempts, and implement additional security measures to prevent cross-site scripting attacks. Developers should restrict create permissions to trusted users and ensure proper input validation and

Why it matters

CVE-2026-84701 is a medium-severity vulnerability in NocoBase that allows users with create permissions to store malicious HTML with event handlers, potentially leading to cross-site scripting attacks. Defenders should prioritize verifying and patching affected installations, as well as monitoring for potential exploitation attempts.

• Defenders must verify and patch affected NocoBase installations to prevent exploitation.
• Security teams should monitor for potential exploitation attempts and implement additional security measures to prevent cross-site scripting attacks.
• Developers should restrict create permissions to trusted users and ensure proper input validation and sanitization.

Technical summary

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record. This issue can lead to cross-site scripting attacks, emphasizing the need for defenders to prioritize verifying and patching affected installations, as well as monitoring for potential exploitation attempts. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying and patching affected NocoBase installations, as well as monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and patch affected NocoBase installations
• Monitor for potential exploitation attempts
• Restrict create permissions to trusted users
• Implement additional security measures to prevent cross-site scripting attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.