CVE-2026-63459 vendurehq CVE debrief

Who should care

Administrators and users with lower privileges who use Vendure should assess exposure and verify if they are using a vulnerable version. They should also review and limit the ability to store and view administrator-controlled descriptions, and monitor for suspicious activity. Affected operator roles include administrators, security teams, and vulnerability management teams responsible for Vendure deployments.

Why it matters

A stored cross-site scripting vulnerability exists in Vendure, an open-source headless commerce platform, prior to version 3.6.5. The vulnerability can compromise the viewing administrator's session and enable cross-privilege or cross-channel administrative actions. Administrators and users with lower privileges should assess exposure and verify if they are using a vulnerable version of Vendure.

• Cross-privilege administrative actions may be enabled
• Cross-channel administrative actions may be enabled
• Compromise of the viewing administrator's session

Technical summary

The RichTextDescriptionCell component in Vendure attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and then reading textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. This allows a lower-privilege administrator to store such markup in descriptions rendered by the Products list, Collections list, Promotions list, Payment Methods list, or Shipping Methods list, and script executes when another administrator views the affected row.

Defensive priority

Administrators and users with lower privileges should assess exposure and verify if they are using a vulnerable version of Vendure. They should also review and limit the ability to store and view administrator-controlled descriptions.

Recommended defensive actions

• Upgrade to version 3.6.5 or later
• Review and limit the ability to store and view administrator-controlled descriptions
• Monitor for suspicious activity and implement compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source references provide information about the vulnerability and its fix in version 3.6.5. However, the exact scope of affected versions and deployments is not specified. Affected Vendure deployments should be identified by administrators and users with lower privileges who use Vendure. They should verify if they are using a vulnerable version and assess exposure. The vulnerability can be triggered by lower-privilege administrators storing markup in descriptions rendered by the Products list, Collections list, Prom

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.