EUVD-2026-43115
GHSA-rq79-xhrq-f62x
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered stored XSS requires a low-privilege authenticated account (PR:L) and victim page view (UI:R); scope changes to browser context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.
AnalysisAI
Stored cross-site scripting in Drupal Commerce Core 3.3.0 through 3.3.5 allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers when affected pages are viewed. The scope change (S:C in the CVSS vector) confirms the payload breaks out of the application's security context into the victim's browser environment, enabling session hijacking or unauthorized UI manipulation. No active exploitation or public exploit code has been identified; EPSS of 0.16% (6th percentile) reflects low real-world exploitation probability at time of analysis.
Technical ContextAI
Drupal Commerce Core is a widely-used e-commerce module for the Drupal CMS, providing product catalog, cart, checkout, and order management functionality. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is persisted to the database and subsequently rendered in HTML responses without adequate output encoding or escaping. The affected CPE is cpe:2.3:a:drupal:commerce_core:*:*:*:*:*:*:*:* covering the 3.3.x branch. The S:C (Scope Changed) CVSS attribute indicates the injected script executes in the context of the victim's browser security origin, distinct from the server-side Drupal application context, consistent with classic stored XSS mechanics.
RemediationAI
Upgrade Drupal Commerce Core to version 3.3.6 or later, which is the vendor-confirmed fixed release per the EUVD affected range (Commerce Core 3.3.0 < 3.3.6). The vendor advisory at https://www.drupal.org/sa-contrib-2026-041 should be consulted for module-specific update instructions via Composer or the Drupal admin interface. If immediate patching is not feasible, a compensating control is to restrict Commerce-related content submission to trusted, vetted user roles only - removing the ability for untrusted authenticated users (e.g., unapproved customer accounts) to submit input into Commerce Core form fields. This reduces the PR:L attack surface but does not eliminate the vulnerability and may impact legitimate customer workflows. Review output filtering and text format configuration on affected content types as an additional hardening measure.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today