CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
A lower-privilege administrator can inject malicious scripts into entity descriptions, leading to session hijacking and privilege escalation when viewed by other admins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63459?
CVE-2026-63459 is a high-severity cross-site scripting vulnerability in vendurehq vendure, published on 17 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.
Weakness: CWE-79
Which versions are affected by CVE-2026-63459?
2 open source packages ship an affected version, including @vendure/dashboard.
| Package | Affected | Fixed in |
|---|---|---|
@vendure/dashboard npm | All versions | 3.6.5 |
@vendure/dashboard npm | All versions | 3.6.5 |
How do I fix CVE-2026-63459?
Upgrade @vendure/dashboard to 3.6.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-63459 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63459 exists.
Sources
Also known as GHSA-xhq9-whgq-49j5.