plone.app.textfield: Stored XSS by spoofing mime type

ImpactA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

Cross-site Scripting (XSS)

plone.app.textfield is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to returning unsanitized RichText content when the stored and output MIME types are identical, which allows an attacker to inject and execute arbitrary JavaScript in a victim's browser...

Cross-site Scripting (XSS)

Overview plone.app.textfield is a Affected versions of this package are vulnerable to Cross-site Scripting XSS. via the RichTextValue.output function when the stored mimeType equals the outputMimeType, causing unsanitized content to bypass the safehtml transform and be rendered directly. An...

plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PT-2026-60894

Name of the Vulnerable Software and Affected Versions plone.app.textfield versions prior to 2.0.2 plone.app.textfield versions prior to 3.0.2 plone.app.textfield versions prior to 4.0.1 Description A stored Cross-Site Scripting XSS issue affects RichText fields. The RichTextValue.output function...