VYPR
Get started
← All advisories
High severityNVD Advisory· Published Mar 10, 2026· Updated Mar 11, 2026

Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking

CVE-2026-29175

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript when any user (including administrators) views the inventory management page. This vulnerability is fixed in 5.5.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
craftcms/commercePackagist
>= 5.0.0, < 5.5.35.5.3

Affected products

1

Patches

1
9f0638a4fb29

Fix XSS

https://github.com/craftcms/commerceNathaniel HammondJan 5, 2026via ghsa
commit
1 file changed · +6 −3
  • src/controllers/InventoryController.php+6 −3 modified
    @@ -281,14 +281,17 @@ public function actionInventoryLevelsTableData(): Response
             $purchasable = \Craft::$app->getElements()->getElementById($inventoryLevel['purchasableId'], siteId: Cp::requestedSite()->id);
             $inventoryItemDomId = sprintf("edit-$id-link-%s", mt_rand());
             if ($purchasable) {
-                $inventoryLevel['purchasable'] = Cp::chipHtml($purchasable, ['labelHtml' => $purchasable->getDescription(), 'showActionMenu' => !$purchasable->getIsDraft() && $purchasable->canSave($currentUser)]);
+                // When providing the `labelHtml` option we need to encode it ourselves
+                $inventoryLevel['purchasable'] = Cp::chipHtml($purchasable, ['labelHtml' => Html::encode($purchasable->getDescription()), 'showActionMenu' => !$purchasable->getIsDraft() && $purchasable->canSave($currentUser)]);
             } else {
-                $inventoryLevel['purchasable'] = $inventoryLevel['description'];
+                $inventoryLevel['purchasable'] = Html::encode($inventoryLevel['description']);
             }
             if (PurchasableHelper::isTempSku($inventoryLevel['sku'])) {
                 $inventoryLevel['sku'] = '';
             }
-            $inventoryLevel['sku'] = Html::tag('span', Html::a($inventoryLevel['sku'], "#", ['id' => "$inventoryItemDomId", 'class' => 'code']));
+
+            // Ensure encoded SKU
+            $inventoryLevel['sku'] = Html::tag('span', Html::a(Html::encode($inventoryLevel['sku']), "#", ['id' => "$inventoryItemDomId", 'class' => 'code']));
             $inventoryLevel['id'] = $id;
 
             $view->registerJsWithVars(fn($id, $params, $inventoryLevelsManagerContainerId) => <<<JS

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.