Is CVE-2026-10769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10769 being exploited in the wild.

How severe is CVE-2026-10769?

Informational severity, with a CVSS score of 6.4, published 10 July 2026.

Is there a fix for CVE-2026-10769?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 3.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10769 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10769?

Check whether you run Drupal Commerce Core or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10769: Drupal Commerce Core Stored XSS in order receipt email template

CVE-2026-10769 · Severity: info · CVSS 6.4 · Published 2026-07-10

Drupal Commerce Core, a framework used to build e-commerce websites, contains a security vulnerability that could allow attackers to inject malicious scripts into order receipt emails. This occurs when the platform fails to properly clean customer comments before including them in automated email templates. If exploited, this could lead to unauthorized actions or data theft when a store administrator or customer views the affected email.

Technologies: Drupal Commerce Core, Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-10769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10769 being exploited in the wild.
How severe is CVE-2026-10769?: Informational severity, with a CVSS score of 6.4, published 10 July 2026.
Which products and versions are affected?: Drupal Commerce Core 3.3.0 to 3.3.5; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=3.3.0,fixed=3.3.6.
Is there a fix for CVE-2026-10769?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 3.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10769 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10769?: Check whether you run Drupal Commerce Core or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 3.3.6 or later

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Drupal Commerce Core due to insufficient sanitization of customer-provided input. Specifically, the 'customer_comments' checkout pane fails to neutralize input before it is rendered in the order receipt email template. An unauthenticated attacker can submit malicious scripts within the comments field during checkout. The vulnerability is triggered when the resulting email is viewed in a web-based email client or within the Drupal administrative interface. This issue affects installations where the 'commerce_checkout' module is enabled and the optional 'Comments' pane is active. The vulnerability is fixed in version 3.3.6.

Affected products

Drupal Commerce Core 3.3.0 to 3.3.5

Identifiers

CVE-2026-10769
DRUPAL-CONTRIB-2026-041

Timeline

2026-06-02: patched: Version 3.3.6 released to address the vulnerability.
2026-06-03: advisory: Drupal security advisory SA-CONTRIB-2026-041 published.
2026-07-10: disclosed: CVE-2026-10769 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.