{"id":"GHSA-8rqh-vxpr-x77p","summary":"plone.restapi: Stored XSS by spoofing mime type","details":"### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer's browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\nThis is the same vulnerability as reported in `plone.app.textfield`:\nhttps://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0 and 6.2, upgrade `plone.restapi` to 9.15.6.\n* For Plone 6.2, upgrade `plone.restapi` to 10.0.1.\n\nThis will prevent abusing the REST API to store wrong rich text values.\n\nThis will **not** prevent XSS from rich text fields that already have wrong values.  For that, you will need a patched `plone.app.textfield` version. See the `plone.app.textfield` advisory linked above for versions.\n\n### Workarounds\nThere is no known workaround.","modified":"2026-07-17T18:45:52.977215601Z","published":"2026-07-17T18:36:34Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-07-17T18:36:34Z","nvd_published_at":null,"cwe_ids":["CWE-80"]},"references":[{"type":"WEB","url":"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"},{"type":"WEB","url":"https://github.com/plone/plone.restapi/security/advisories/GHSA-8rqh-vxpr-x77p"},{"type":"PACKAGE","url":"https://github.com/plone/plone.restapi"}],"affected":[{"package":{"name":"plone-restapi","ecosystem":"PyPI","purl":"pkg:pypi/plone-restapi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15.6"}]}],"versions":["1.0.0","1.0a1","1.0a10","1.0a11","1.0a12","1.0a13","1.0a14","1.0a15","1.0a16","1.0a17","1.0a18","1.0a19","1.0a2","1.0a20","1.0a21","1.0a22","1.0a23","1.0a24","1.0a25","1.0a3","1.0a4","1.0a5","1.0a6","1.0a7","1.0a8","1.0a9","1.0b1","1.1.0","1.2.0","1.3.0","1.3.1","1.4.0","1.4.1","1.5.0","1.6.0","2.0.0","2.0.1","2.1.0","2.2.0","2.2.1","3.0.0","3.1.0","3.2.0","3.2.1","3.2.2","3.3.0","3.4.0","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5.0","3.5.1","3.5.2","3.6.0","3.7.0","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.8.0","3.8.1","3.9.0","4.0.0","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.2.0","4.3.0","4.3.1","4.4.0","4.5.0","4.5.1","4.6.0","5.0.0","5.0.1","5.0.2","5.0.3","5.1.0","6.0.0","6.1.0","6.10.0","6.11.0","6.12.0","6.13.0","6.13.1","6.13.2","6.13.3","6.13.4","6.13.5","6.13.6","6.13.7","6.13.8","6.14.0","6.15.0","6.15.1","6.2.0","6.2.1","6.2.2","6.2.3","6.2.4","6.3.0","6.4.0","6.4.1","6.5.0","6.5.1","6.5.2","6.6.0","6.6.1","6.7.0","6.8.0","6.8.1","6.9.0","6.9.1","7.0.0","7.0.0a1","7.0.0a2","7.0.0a3","7.0.0a4","7.0.0a5","7.0.0a6","7.0.0b1","7.0.0b2","7.0.0b3","7.0.0b4","7.0.0b5","7.0.0b6","7.0.0b7","7.0.0b8","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.3.3","7.3.4","7.3.5","7.3.7","7.3.8","7.4.0","7.4.1","7.5.0","7.6.0","7.7.0","7.7.1","7.8.0","7.8.1","7.8.2","7.8.3","7.9.0","7.9.1","8.0.0","8.1.0","8.10.0","8.11.0","8.12.0","8.12.1","8.13.0","8.14.0","8.15.0","8.15.1","8.15.2","8.15.3","8.16.0","8.16.1","8.16.2","8.17.0","8.18.0","8.18.1","8.19.0","8.2.0","8.20.0","8.21.0","8.21.1","8.21.2","8.22.0","8.23.0","8.24.0","8.24.1","8.25.0","8.25.1","8.26.0","8.27.0","8.28.0","8.29.0","8.3.0","8.3.1","8.3.2","8.30.0","8.30.1.dev0","8.31.0","8.32.0","8.32.1","8.32.2","8.32.3","8.32.4","8.32.4.dev0","8.32.5","8.32.6","8.33.0","8.33.1","8.33.2","8.33.3","8.33.4.dev0","8.34.0","8.35.0","8.35.1","8.35.2","8.35.3","8.36.0","8.36.1","8.37.0","8.38.0","8.39.0","8.39.1","8.39.2","8.4.0","8.4.1","8.4.2.dev0","8.40.0","8.41.0","8.42.0","8.42.1","8.43.0","8.43.1","8.43.2","8.43.3","8.5.0","8.6.0","8.6.1","8.7.0","8.7.1","8.8.0","8.8.1","8.9.0","8.9.1","9.0.0","9.1.0","9.1.1","9.1.2","9.10.0","9.11.0","9.12.0","9.13.0","9.13.1","9.13.2","9.13.3","9.13.4","9.13.5","9.14.0","9.15.0","9.15.1","9.15.2","9.15.3","9.15.4","9.15.5","9.2.0","9.2.1","9.3.0","9.4.0","9.4.1","9.4.2","9.5.0","9.6.0","9.6.1","9.7.0","9.7.1","9.7.2","9.8.0","9.8.1","9.8.2","9.8.3","9.8.4","9.8.5","9.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8rqh-vxpr-x77p/GHSA-8rqh-vxpr-x77p.json"}},{"package":{"name":"plone-restapi","ecosystem":"PyPI","purl":"pkg:pypi/plone-restapi"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.1"}]}],"versions":["10.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8rqh-vxpr-x77p/GHSA-8rqh-vxpr-x77p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}