Executive brief
Vendure's admin dashboard contains a stored cross-site scripting (XSS) vulnerability in how it displays product, collection, promotion, and payment method descriptions. A lower-privilege administrator can inject malicious HTML (such as an image tag with an event handler) into a description field; when any administrator opens a list view showing that description, the malicious code executes in their browser with their admin privileges. This allows privilege escalation and account takeover across admin tiers and sales channels.
Technical details
The vulnerability exists in RichTextDescriptionCell (packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx), which attempts to sanitize HTML by creating a detached div element, assigning untrusted description content to its innerHTML property, and returning the textContent. However, innerHTML still parses and executes active markup—specifically resource-loading handlers such as img onerror, svg handlers, and image elements—even on detached nodes. Reading textContent afterwards does not prevent the event handler from firing. The vulnerable code is used to render the description column across products, collections, promotions, payment methods, and shipping methods—all editable by channel-scoped administrators. An attacker with UpdateCatalog/UpdateProduct permissions can set a description to <img src=x onerror="[payload]">, which executes when any administrator views the list. The resulting JavaScript runs with the viewing admin's privileges, enabling session token exfiltration, admin action forgery, and cross-channel/cross-privilege takeover. Patch 3.6.5 replaces the dangerous pattern with an inert DOMParser or HTML sanitization library.
Affected products
- Vendure @vendure/dashboard < 3.6.5
Timeline
- 2026-07-01: disclosed: GitHub Security Advisory published (CVE-2026-63459)
- 2026-09-17: patched: Version 3.6.5 released with fix