CyberRota Analysis
AI-GeneratedThe Vendure open-source headless commerce platform is vulnerable to stored cross-site scripting (XSS) due to improper handling of user-controlled descriptions in various administrative interfaces prior to version 3.6.5. This vulnerability allows a lower-privilege administrator to inject malicious scripts that execute when another administrator views the affected content, potentially compromising their session and enabling unauthorized actions. Organizations using Vendure should prioritize upgrading to version 3.6.5 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.