AIKIDO-2026-629168

TL;DR

The dashboard RichTextDescriptionCell strips HTML by assigning untrusted content to an element's innerHTML and reading back its textContent. Parsing the markup still triggers active handlers such as an img onerror, so a lower-privileged administrator can store a payload in a description field that executes when a higher-privileged administrator views the list. The fix parses the content with an inert parser that does not execute scripts or load resources.