Vulnerability Description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row. This stored cross-site scripting can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. This issue is fixed in version 3.6.5.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/vendurehq/vendure/commit/d7aa42a3f0cb524297a1a2fdf700e4aba9ac
- https://github.com/vendurehq/vendure/releases/tag/v3.6.5
- https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5
FAQ
What is CVE-2026-63459?
CVE-2026-63459 is a vulnerability with a CVSS score of 8.7 (HIGH). Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to str...
How severe is CVE-2026-63459?
CVE-2026-63459 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-63459?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.