CVE-2026-128053
Received Received - Intake

Reflected XSS in OpenMage Magento-LTS Error Pages

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128053
EUVD
EUVD-2026-125056

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openmage magento_lts to 20.18.2 (exc)
openmage magento_lts to 21.0.0-beta3 (exc)
openmage magento_lts From 21.0.0-beta1 (inc) to 21.0.0-beta3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in OpenMage Magento-LTS error pages. It occurs because URLs derived from the SCRIPT_NAME variable are printed without proper escaping on error pages like 404 or 503. Attackers can craft malicious links that execute arbitrary JavaScript in victims' browsers when error pages render.

Detection Guidance

Check OpenMage Magento-LTS versions before 20.18.2, 21.0.0-beta1 to 21.0.0-beta2 for unescaped error pages. Inspect error pages like 404, 503, or report pages for URLs derived from SCRIPT_NAME without htmlspecialchars escaping. Use browser developer tools to check if error pages reflect user input in URLs or exception messages.

Impact Analysis

Unauthenticated attackers can trick users into clicking malicious links, leading to script execution in their browsers. This could steal session cookies, deface pages, or perform actions on behalf of the user. Exploitation requires specific server configurations and user interaction.

Mitigation Strategies

Upgrade OpenMage Magento-LTS to patched versions 20.18.2, 20.19.0, or 21.0.0-beta3 or later. Apply htmlspecialchars with ENT_QUOTES and UTF-8 encoding to error page outputs. Ensure SCRIPT_NAME is configured securely to avoid deriving from request paths. Disable exception printing in production environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128053. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...