Medium severity4.4NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026
CVE-2026-110239
CVE-2026-110239
Description
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without sanitisation. Authenticated users can set the bound property through the Livewire client API to store JavaScript that executes when administrators open the record's form.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <9.20.0
Patches
Vulnerability mechanics
References
5- github.com/zofe/rapyd-admin/blob/v9.19.0/resources/views/components/rich-text.blade.phpnvd
- github.com/zofe/rapyd-admin/blob/v9.19.0/src/helpers.phpnvd
- github.com/zofe/rapyd-admin/commit/acd6ee85f9e5ccec67199673b039c605d161406anvd
- github.com/zofe/rapyd-admin/releases/tag/v9.20.0nvd
- www.vulncheck.com/advisories/rapyd-admin-before-9.20.0-stored-xss-via-rich-text-componentnvd
News mentions
0No linked articles in our index yet.