High, CVSS 8.7npmAmendedPublished
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
CVE-2026-63459 · GHSA-xhq9-whgq-49j5
- Affected
- npm @vendure/dashboard < 3.6.5
- Fixed in
- 3.6.5· Vendor fix available
- Issue
- Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions Package: @vendure/dashboard (vendure-ecommerce/vendure, latest master) · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's innerHTML and reading back textContent. This pattern still executes active markup: a description containing <img src=x onerror=… runs script when the element is parsed (image resource loads even on a detached node in Chromium/Firefox, firing onerror). Because description is an admin-settable field shown in multiple list views, a lower-privilege administrator can store a payload that executes in a higher-privilege administrator's browser when they open the corresponding list — stored XSS leading to admin-session compromise. Vulnerable code packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx innerHTML does not run <script, but it does trigger resource loads /…
Recommended action: Upgrade to 3.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.