Cross-Site Scripting Vulnerability in Mendix Rich Text Widget

An authenticated user could inject malicious scripts that execute in the browser of other users viewing the content, potentially allowing credential theft or unauthorized actions within the application.

Organizations using Mendix-based applications that include the RichText widget (especially those used for content creation, documentation, or user-facing forms in any sector including utilities, manufacturing, and critical infrastructure) should update immediately to prevent XSS attacks through user-generated content.

An attacker with valid application credentials enters malicious JavaScript code into a Mendix RichText field. When another user views or edits that content, the script executes in their browser with their privileges, allowing the attacker to steal session tokens, modify displayed data, or perform actions on behalf of the victim user.