Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-54503plone.app.textfield: Stored XSS by spoofing mime type

Medium 4.3

In plain English

A medium-severity security flaw in plone.app.textfield from plone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 65.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	plone-app-textfield	2.0.2	GHSA-4r4f-gg25-rmg5
PyPI	plone-app-textfield	3.0.2	GHSA-4r4f-gg25-rmg5
PyPI	plone-app-textfield	4.0.1	GHSA-4r4f-gg25-rmg5
PyPI	plone-app-textfield	2.0.2, 3.0.2, 4.0.1	PYSEC-2026-3497

Affected products (as reported)

Vendor	Product	Versions
plone	plone.app.textfield	< 2.0.2>= 3.0.0, < 3.0.2>= 4.0.0, < 4.0.1

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5 x_refsource_CONFIRM
https://github.com/plone/plone.app.textfield/commit/0da1aeec2406cf640977eb857a03e792d2c7cac2 x_refsource_MISC
https://github.com/plone/plone.app.textfield/commit/467638e500d804c637031387a227a2b02d12a86f x_refsource_MISC
https://github.com/plone/plone.app.textfield/commit/781d517a38524087fe57525a94806684908f852f x_refsource_MISC