{"answers":{"affected":"4 open source packages ship an affected version, including plone-restapi and plone.restapi.","exploited":"There is no known exploitation of GHSA-8rqh-vxpr-x77p in the wild and no public exploit code.","fix":"Upgrade plone-restapi to a fixed version for your release line: 9.15.6 or 10.0.1.","what":"GHSA-8rqh-vxpr-x77p is a cross-site scripting vulnerability in plone-restapi, published on 17 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-8rqh-vxpr-x77p and fix it if it is affected.\n\nWhat it is: GHSA-8rqh-vxpr-x77p is a cross-site scripting vulnerability in plone-restapi, published on 17 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-8rqh-vxpr-x77p in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- plone-restapi (PyPI): affected all versions; fixed in 9.15.6\n- plone-restapi (PyPI): affected from 10.0.0; fixed in 10.0.1\n- plone.restapi (PyPI): affected all versions; fixed in 9.15.6\n- plone.restapi (PyPI): affected from 10.0.0; fixed in 10.0.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-8rqh-vxpr-x77p/ (Markdown: https://insights.sbomify.com/GHSA-8rqh-vxpr-x77p/index.md)","id":"GHSA-8rqh-vxpr-x77p","markdown":"https://insights.sbomify.com/GHSA-8rqh-vxpr-x77p/index.md","name":"GHSA-8rqh-vxpr-x77p","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Plone REST API","requires_auth":"low_privilege","summary":"Stored XSS in Plone REST API allows attackers to execute scripts in viewers' browsers via unsanitized RichText fields.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nA stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type (`text/x-html-safe`) is the type that signifies \"already sanitized\", any value whose stored mimeType equals it bypasses the safe_html transform entirely on render. The transform itself is sound — it correctly strips `on*` event-handler attributes and `javascript:/data:` URIs; the defect is that it is never invoked for these values. The unsanitized value is then emitted via `tal:content=\"structure ...\"`, which performs no escaping, so the payload executes in the viewer's browser. \n\nThis can be a problem when a RichText field is wrongly defined in code with a `mimeType` and `outputMimeType` that are the same, or when the REST API is used to the same effect.\n\nThis is the same vulnerability as reported in `plone.app.textfield`:\nhttps://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5\n\n### Patches\nThe problem has been patched:\n\n* For Plone 6.0 and 6.2, upgrade `plone.restapi` to 9.15.6.\n* For Plone 6.2, upgrade `plone.restapi` to 10.0.1.\n\nThis will prevent abusing the REST API to store wrong rich text values.\n\nThis will **not** prevent XSS from rich text fields that already have wrong values.  For that, you will need a patched `plone.app.textfield` version. See the `plone.app.textfield` advisory linked above for versions.\n\n### Workarounds\nThere is no known workaround.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"plone.restapi: Stored XSS by spoofing mime type","id":"GHSA-8rqh-vxpr-x77p","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["9.15.6"],"introduced":["0"],"last_affected":[],"package":"plone-restapi","purl":"pkg:pypi/plone-restapi","source":"GHSA-8rqh-vxpr-x77p"},{"ecosystem":"PyPI","fixed":["10.0.1"],"introduced":["10.0.0"],"last_affected":[],"package":"plone-restapi","purl":"pkg:pypi/plone-restapi","source":"GHSA-8rqh-vxpr-x77p"},{"ecosystem":"PyPI","fixed":["9.15.6"],"introduced":["0"],"last_affected":[],"package":"plone.restapi","purl":null,"source":"GHSA-8rqh-vxpr-x77p"},{"ecosystem":"PyPI","fixed":["10.0.1"],"introduced":["10.0.0"],"last_affected":[],"package":"plone.restapi","purl":null,"source":"GHSA-8rqh-vxpr-x77p"}],"products":null,"published":"2026-07-17","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Stored XSS in Plone REST API allows attackers to execute scripts in viewers' browsers via unsanitized RichText fields.","url":"https://insights.sbomify.com/GHSA-8rqh-vxpr-x77p/"}