Description

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-17T15:16:49.290Z",
  "pubdate": "2026-09-17T15:16:49.290Z",
  "executiveSummary": "Vendure prior to version 3.6.5 contains a stored Cross-Site Scripting (XSS) vulnerability located in the RichTextDescriptionCell component.\nThe vulnerability arises from insecure handling of administrative input, allowing an attacker with lower-level administrative privileges to inject malicious markup into various entity descriptions, including Products, Collections, Promotions, Payment Methods, and Shipping Methods.\nWhen a higher-privileged administrator views a row containing the crafted payload, the malicious script executes within their session context.\nThis flaw allows for unauthorized administrative actions, session hijacking, and cross-privilege escalation, posing a significant risk to the integrity and confidentiality of the Vendure commerce platform.\nSuccessful exploitation requires authenticated access to the administrative dashboard, specifically with permissions to modify resource descriptions.",
  "technicalDetails": "The vulnerability resides in the RichTextDescriptionCell component located at packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx.\nThe root cause is an improper sanitization implementation that relies on DOM manipulation to strip markup. The application assigns user-controlled description strings directly to an element's innerHTML property before subsequently extracting the textContent. Because the assignment to innerHTML occurs before the content is sanitized or processed as text, the browser's HTML parser initializes the provided string as active DOM nodes.\nIf the payload includes active resource markup—such as an <img> tag with an onerror event handler—the browser attempts to load the resource upon assignment. Since the DOM is live during the innerHTML assignment, the event handler executes immediately before the subsequent logic can reach the textContent retrieval phase.\nThe attack flow proceeds as follows: 1. An attacker with sufficient permissions to modify entity metadata (e.g., product descriptions) injects a malicious payload containing an XSS vector into the description field. 2. The Vendure server stores this payload in the database. 3. When an unsuspecting administrator navigates to the list view (Products, Collections, etc.) that invokes RichTextDescriptionCell, the frontend component retrieves the stored description. 4. The application logic injects the malicious payload into the innerHTML of a temporary DOM element. 5. The browser executes the injected event handler (e.g., JavaScript within an onerror or onload attribute). 6. The script operates within the context of the victim administrator's session, enabling the execution of arbitrary administrative API calls or session token exfiltration.\nThis vulnerability is critical because it leverages the high-trust environment of the administrative dashboard. By compromising a higher-privileged user session, the attacker can perform unauthorized platform configurations, access sensitive commerce data, or further compromise the infrastructure, effectively bypassing authorization boundaries between administrative roles."
}