{"answers":{"affected":"7 open source packages ship an affected version, including plone.app.textfield and plone-app-textfield.","exploited":"There is no known exploitation of CVE-2026-54503 in the wild and no public exploit code.","fix":"Upgrade plone.app.textfield to a fixed version for your release line: 2.0.2, 3.0.2 or 4.0.1.","what":"CVE-2026-54503 is a medium-severity cross-site scripting vulnerability in plone.app.textfield, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-54503 and fix it if it is affected.\n\nWhat it is: CVE-2026-54503 is a medium-severity cross-site scripting vulnerability in plone.app.textfield, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-54503 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- plone.app.textfield (PyPI): affected all versions; fixed in 2.0.2\n- plone.app.textfield (PyPI): affected from 3.0.0; fixed in 3.0.2\n- plone.app.textfield (PyPI): affected from 4.0.0; fixed in 4.0.1\n- plone-app-textfield (PyPI): affected all versions; fixed in 2.0.2, 3.0.2, 4.0.1\n- plone-app-textfield (PyPI): affected all versions; fixed in 2.0.2\n- plone-app-textfield (PyPI): affected from 3.0.0; fixed in 3.0.2\n- plone-app-textfield (PyPI): affected from 4.0.0; fixed in 4.0.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-54503/ (Markdown: https://insights.sbomify.com/CVE-2026-54503/index.md)","id":"CVE-2026-54503","markdown":"https://insights.sbomify.com/CVE-2026-54503/index.md","name":"CVE-2026-54503","record":{"aliases":["GHSA-4r4f-gg25-rmg5","PYSEC-2026-3497"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Plone textfield library","requires_auth":"low_privilege","summary":"Attackers can store malicious JavaScript in RichText fields that executes in viewers' browsers due to unsanitized output when MIME types match.","user_interaction":"not_required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":4.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page"}],"description":"plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"plone.app.textfield: Stored XSS by spoofing mime type","id":"CVE-2026-54503","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":7,"n_references":4,"next":{"headline":"MCP Documentation Server: Web UI API binds to all interfaces without authentication by default","id":"CVE-2026-54504"},"packages":[{"ecosystem":"PyPI","fixed":["2.0.2","3.0.2","4.0.1"],"introduced":["0","3.0.0","4.0.0"],"last_affected":[],"package":"plone-app-textfield","purl":"pkg:pypi/plone-app-textfield","source":"PYSEC-2026-3497"},{"ecosystem":"PyPI","fixed":["2.0.2"],"introduced":["0"],"last_affected":[],"package":"plone-app-textfield","purl":"pkg:pypi/plone-app-textfield","source":"GHSA-4r4f-gg25-rmg5"},{"ecosystem":"PyPI","fixed":["3.0.2"],"introduced":["3.0.0"],"last_affected":[],"package":"plone-app-textfield","purl":"pkg:pypi/plone-app-textfield","source":"GHSA-4r4f-gg25-rmg5"},{"ecosystem":"PyPI","fixed":["4.0.1"],"introduced":["4.0.0"],"last_affected":[],"package":"plone-app-textfield","purl":"pkg:pypi/plone-app-textfield","source":"GHSA-4r4f-gg25-rmg5"},{"ecosystem":"PyPI","fixed":["2.0.2"],"introduced":["0"],"last_affected":[],"package":"plone.app.textfield","purl":null,"source":"GHSA-4r4f-gg25-rmg5"},{"ecosystem":"PyPI","fixed":["3.0.2"],"introduced":["3.0.0"],"last_affected":[],"package":"plone.app.textfield","purl":null,"source":"GHSA-4r4f-gg25-rmg5"},{"ecosystem":"PyPI","fixed":["4.0.1"],"introduced":["4.0.0"],"last_affected":[],"package":"plone.app.textfield","purl":null,"source":"GHSA-4r4f-gg25-rmg5"}],"prev":{"headline":"Oj: Stack Buffer Overflow in Oj.dump via Large Indent","id":"CVE-2026-54502"},"products":["plone.app.textfield"],"published":"2026-09-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-15","vendors":["plone"]},"summary":"Attackers can store malicious JavaScript in RichText fields that executes in viewers' browsers due to unsanitized output when MIME types match.","url":"https://insights.sbomify.com/CVE-2026-54503/"}