Description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
Published: 2026-10-13
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Stored XSS
Action: Update
AI Analysis

Impact

The vulnerability is a stored cross‑site scripting flaw located in the x‑rpd::rich‑text Blade component of Rapyd Admin. Bound model values are rendered as raw HTML without sanitisation, allowing an authenticated user to inject JavaScript that will run when any administrator opens the affected record’s form.

Affected Systems

Rapyd Admin v9.19.0 and all older releases are affected. The issue is fixed in v9.20.0 and later.

Risk and Exploitability

The CVSS score is 2.1, indicating a low severity risk. There is no EPSS data available and the issue is not included in the CISA KEV catalog. Because the flaw requires authenticated access to set bound properties via the Livewire client API, an attacker must already possess valid user credentials with permission to modify the component. Once the malicious script is stored, any administrator who opens the record will execute the injected code in their browser context.

Generated by OpenCVE AI on October 17, 2026 at 05:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Rapyd Admin v9.20.0 or a newer release to apply the vendor fix.
  • If an upgrade is not immediately possible, disable or remove the x‑rpd::rich‑text component from rendering templates.
  • Implement server‑side sanitisation or escape all user‑supplied content before it is embedded as raw HTML, or restrict the Livewire API to allow only trusted roles to set bound properties.

Generated by OpenCVE AI on October 17, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Zofe
Zofe rapyd-admin
Vendors & Products Zofe
Zofe rapyd-admin

Tue, 13 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
Title Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Zofe Rapyd-admin
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T15:57:06.011Z

Reserved: 2026-10-13T18:00:12.948Z

Link: CVE-2026-110239

cve-icon Vulnrichment

Updated: 2026-10-14T14:49:27.188Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:18:49.210

Modified: 2026-10-14T16:17:40.797

Link: CVE-2026-110239

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T06:00:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')