CVE-2026-63459 Details
Description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.
A stored cross-site scripting vulnerability has been identified in Vendure versions prior to 3.6.5. The issue arises in the RichTextDescriptionCell component of the admin dashboard, where entity descriptions are processed by assigning them to an element's innerHTML. This method of stripping HTML is unsafe, as it allows active markup, such as image tags with event handlers, to execute before the text content is extracted. Lower-privilege administrators can exploit this by injecting malicious scripts into descriptions that are later viewed by higher-privilege admins, potentially compromising their sessions and allowing unauthorized administrative actions.
Users are advised to upgrade to Vendure version 3.6.5, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/vendurehq/vendure/commit/d7aa42a3f0cb524297a1a2fdf700e4aba9aca684 | [email protected] | Source CodeVendor |
| https://github.com/vendurehq/vendure/releases/tag/v3.6.5 | [email protected] | Release NotesVendor |
| https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vendure | < 3.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |