Executive brief
Bagisto, an open-source e-commerce platform, is vulnerable to a security flaw that allows attackers to run malicious scripts in an administrator's browser. By simply registering a new customer account with a specially crafted name, an attacker can trigger this script when an administrator views the 'Create Order' page. This could lead to unauthorized actions being performed on behalf of the administrator or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Bagisto versions prior to 2.4.4 due to client-side template injection (CSTI). The root cause is located in the 'create.blade.php' template, which fails to use the Vue.js 'v-pre' directive when rendering customer name fields. This oversight allows Vue.js to interpret and execute template expressions stored in the database (such as those provided during customer registration) as live JavaScript. An attacker can exploit this by registering a customer account with a malicious payload in the first or last name fields; the script executes when an authenticated administrator navigates to the 'Create Order' page for that customer. The issue is resolved in version 2.4.4.
Affected products
- Bagisto Bagisto < 2.4.4
Timeline
- 2026-05-05: patched: Version 2.4.4 released
- 2026-07-09: disclosed: CVE-2026-60120 published