{"id":"PYSEC-2026-3497","summary":"plone.app.textfield: Stored XSS by spoofing mime type ","details":"### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer's browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0, upgrade `plone.app.textfield` to 2.0.2.\n* For Plone 6.1, upgrade `plone.app.textfield` to 3.0.2.\n* For Plone 6.2, upgrade `plone.app.textfield` to 4.0.1.\n\n### Workarounds\nThere is no known workaround.","aliases":["CVE-2026-54503","GHSA-4r4f-gg25-rmg5"],"modified":"2026-07-23T15:00:19.411920440Z","published":"2026-07-23T11:41:46.855463Z","references":[{"type":"WEB","url":"https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5"},{"type":"PACKAGE","url":"https://github.com/plone/plone.app.textfield"},{"type":"PACKAGE","url":"https://pypi.org/project/plone-app-textfield"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4r4f-gg25-rmg5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54503"}],"affected":[{"package":{"name":"plone-app-textfield","ecosystem":"PyPI","purl":"pkg:pypi/plone-app-textfield"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2"},{"introduced":"3.0.0"},{"fixed":"3.0.2"},{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["1.0","1.0.1","1.0.2","1.0b1","1.0b2","1.0b3","1.0b4","1.0b5","1.0b6","1.0b7","1.1","1.2","1.2.1","1.2.10","1.2.11","1.2.12","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","2.0.0","2.0.1","3.0.0","3.0.1","4.0.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/plone-app-textfield/PYSEC-2026-3497.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}