Quick answers
- Is CVE-2026-118558 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118558 being exploited in the wild.
- How severe is CVE-2026-118558?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- Drupal Commerce Stripe 2.0.0 to 2.2.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe ECOSYSTEM:introduced=2.0.0,fixed=2.2.3.
- Is there a fix for CVE-2026-118558?
- Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe: upgrade to 2.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118558 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-118558?
- Check whether you run Drupal Commerce Stripe or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce Stripe: upgrade to 2.2.3 or later
Technical details
The module fails to include a CSRF token in the redirect URI when calling the Stripe Connect API to generate authorization codes. An attacker can craft a malicious link that, when clicked by an authenticated administrator, bypasses payment validation and marks an order as paid. This is a classic CSRF vulnerability requiring administrator interaction and Stripe Connect redirection flow exploitation.
Affected products
- Drupal Commerce Stripe 2.0.0 to 2.2.2
Identifiers
- CVE-2026-118558
- DRUPAL-CONTRIB-2026-263
Timeline
- 2026-10-28: disclosed