Craft CMS - Stored XSS in Table Field via Row Heading Column Type

An attacker with an administrator account (and `allowAdminChanges` enabled) creates or edits a Table field, sets a column type to **Row Heading**, and inserts a malicious payload such as `<img src=x onerror='alert("XSS")'>` into the **Default Values** row heading. When another user views any page that renders that table field (e.g., a user profile), the unsanitized heading is output in the browser, causing the injected script to execute [ref_id=1]. The vulnerability is a stored cross-site scripting (XSS) weakness because the application fails to sanitize input within row heading default values [ref_id=1].

The patch [ref_id=2] removes the `Html::encode()` call from `_normalizeCellValue()` for the `'heading'` case and instead moves the encoding into `_getInputHtml()`, where the value is wrapped as `['value' => Html::encode($row[$colId]), ...]` only when the column type is `'heading'`. This ensures that row heading values are HTML-encoded at the point of output rather than during normalization, preventing stored XSS while preserving the original value in the database.

Navigate to Settings → Fields and create a new field with Type: Table. Add a Column Heading and set Column Type to **Row Heading**. In the Default Values section, add a row with the payload `<img src=x onerror='alert("XSS")'>`. Enable **Static Rows**. Use the field in any object (e.g., user profile fields) and then visit any user's profile to observe the XSS execution [ref_id=1].