CVE-2026-54503 plone.app.textfield: Stored XSS by spoofing mime type
Attackers can store malicious JavaScript in RichText fields that executes in viewers' browsers due to unsanitized output when MIME types match.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54503?
CVE-2026-54503 is a medium-severity cross-site scripting vulnerability in plone.app.textfield, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.
Weakness: CWE-80
Which versions are affected by CVE-2026-54503?
7 open source packages ship an affected version, including plone.app.textfield and plone-app-textfield.
| Package | Affected | Fixed in |
|---|---|---|
plone.app.textfield PyPI | All versions | 2.0.2 |
plone.app.textfield PyPI | From 3.0.0 | 3.0.2 |
plone.app.textfield PyPI | From 4.0.0 | 4.0.1 |
plone-app-textfield PyPI | All versions | 2.0.2, 3.0.2, 4.0.1 |
plone-app-textfield PyPI | All versions | 2.0.2 |
plone-app-textfield PyPI | From 3.0.0 | 3.0.2 |
1 more packages
plone-app-textfield PyPI | From 4.0.0 | 4.0.1 |
How do I fix CVE-2026-54503?
Upgrade plone.app.textfield to a fixed version for your release line: 2.0.2, 3.0.2 or 4.0.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-54503 being exploited?
There is no known exploitation of CVE-2026-54503 in the wild and no public exploit code.
Sources
Also known as GHSA-4r4f-gg25-rmg5, PYSEC-2026-3497.