NocoBase does not properly sanitize the content of rich text fields when they are rendered for viewing. A user with permission to create records can use the collection API to embed arbitrary HTML that includes event handlers. Once stored, the malicious markup is displayed in the browser of any user who views the affected record, allowing client‑side script execution that runs with the privileges of the logged‑in user.

The vulnerability affects the NocoBase platform. No specific version information is provided in the advisory. Users should verify whether their NocoBase installation incorporates the rich text field renderer exposed via the API and determine if it is impacted.

The assigned CVSS score of 5.1 indicates a moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. An attacker only needs authenticated create‑level API privileges to inject the payload; the attack vector is thus authenticated and relatively easy for users with such permissions. Once executed, the script runs in the victim’s browser, enabling data theft or session hijacking.