CVE-2026-63459
HighCVSS 8.7Summary
Vendure prior to 3.6.5 contains a stored XSS vulnerability in RichTextDescriptionCell, which assigns an administrator-controlled description to a live element's innerHTML and then reads textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products, Collections, Promotions, Payment Methods, or Shipping Methods lists, and script executes when another administrator views the affected row.
Risk Assessment
This can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. The issue is fixed in version 3.6.5.
Recommendation
Upgrade Vendure to version 3.6.5 or later. Until then, restrict description editing privileges and review content entered by administrators.
Other vulnerabilities in Vendure
See all- CVE-2026-63461Medium
In Vendure prior to 3.6.5, public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets.
- CVE-2026-63460High
Vendure prior to 3.6.5 allows an unauthenticated caller to supply a catastrophically backtracking regular expression pattern through StringOperators.regex in the public Shop GraphQL API. Deployments using better-sqlite3 and sqljs evaluate the pattern synchronously in the Node.js event loop, which can block request processing. The issue is fixed in version 3.6.5.
- CVE-2026-67347Medium
A vulnerability in Vendure (up to version 3.7.1) allows channel-scoped administrators to modify other tenants' data by bypassing channel isolation validation. The attack involves supplying global IDs of StockLocation or Asset entities from different channels.
- CVE-2026-63472Critical
In Vendure, the createCustomerAndUser function in external authentication matches an existing customer by email address and attaches a new external authentication method without requiring verification. An attacker can use an unverified email to hijack the victim's account.
Original NVD description (English source)
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.