CVE-2026-76837

Name of the Vulnerable Software and Affected Versions Baserow versions prior to 2.3.0

Description Baserow fails to HTML encode a user's display name when interpolating it into rich-text mention markup. The endpoint 'PATCH /api/user/account/' stores the first name value verbatim. Subsequently, the mention renderer in web-frontend/modules/core/editor/mention.js uses a template literal to place this name into a data-label attribute and the element body without escaping. A name containing a double quote can close the attribute and the opening tag, allowing subsequent markup to be injected into the element content. Because rich-text field components render this result through v-html, any rich-text cell mentioning the account executes the stored script for every workspace member who views the table without requiring a click. Any workspace member, regardless of permission level, can set their name to deliver the payload, which persists until the name is changed or the mentioning row is removed.

Recommendations Update to version 2.3.0.