EUVD-2026-81670
GHSA-xhq9-whgq-49j5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Low-privilege admin (PR:L) stores markup executed in a higher-privilege admin's browser on page view (UI:R), crossing the privilege boundary (S:C) with session/account compromise (C:H/I:H), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.
AnalysisAI
Stored cross-site scripting in the Vendure Admin Dashboard (@vendure/dashboard prior to 3.6.5) lets an authenticated, low-privilege administrator store markup in an entity description that executes in a higher-privilege administrator's browser when that administrator opens the affected Products, Collections, Promotions, Payment Methods or Shipping Methods list view, enabling session compromise and cross-privilege or cross-channel administrative actions. The root cause is CWE-79: RichTextDescriptionCell 'strips' HTML by assigning the attacker-controlled description to a live element's innerHTML and only afterwards reading textContent, so active markup such as <img src=x onerror=...> fires during the assignment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Vendure administrator account with description-write permission (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 8.7 (High) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, which the input data supports: this is a network-reachable, low-complexity stored XSS requiring an authenticated but low-privilege administrator (PR:L) and victim interaction (UI:R, a higher-privilege admin simply opening a list view). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 3.6.5 - upgrade Vendure (and the @vendure/dashboard package) to 3.6.5 or later, as published in release tag v3.6.5 (https://github.com/vendurehq/vendure/releases/tag/v3.6.5) and implemented by commit d7aa42a3f0cb524297a1a2fdf700e4aba9aca684, which swaps the innerHTML-based stripping in RichTextDescriptionCell for new DOMParser().parseFromString(value, 'text/html').body.textContent, an inert parse that neither executes event handlers nor loads resources; full details are in the advisory at https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment running @vendure/dashboard and enumerate administrator accounts, paying particular attention to any user holding a low-privilege role with edit rights over the description fields on Products, Collections, Promotions, Payment Methods or Shipping Methods; trim that population to the minimum necessary and confirm that administrative audit logging and session monitoring are enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today