Cross-Site Scripting Vulnerability in Mendix Rich Text Widget

A user with engineering credentials could inject malicious scripts into rich text fields that execute in other users' browsers, potentially compromising session data or access to sensitive process information displayed in the application.

Organizations using Mendix applications for process monitoring or control systems (HMI/SCADA front-ends, data visualization dashboards) should assess if they use the RichText widget for displaying or collecting operational notes, alarm descriptions, or other user-editable text fields.

An authenticated user (engineer or operator) enters malicious JavaScript code into a Mendix RichText editor field. When another user views that content in their browser, the script executes in their session context, allowing the attacker to steal session tokens, modify displayed data, or redirect them to a malicious site.