CVE-2026-22849
BaseFortify
Publication date: 2026-01-21
Last updated on: 2026-01-29
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| saleor | saleor | From 3.0.0 (inc) to 3.20.108 (exc) |
| saleor | saleor | From 3.21.0 (inc) to 3.21.43 (exc) |
| saleor | saleor | From 3.22.0 (inc) to 3.22.27 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-83 | The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Saleor e-commerce platform allows users to modify rich text fields with HTML without backend HTML cleaning, enabling malicious actors to perform stored cross-site scripting (XSS) attacks on dashboards and storefronts. Malicious staff members could inject scripts targeting other staff, potentially stealing their access and refresh tokens. The issue affects versions from 3.0.0 up to but not including 3.20.108, 3.21.43, and 3.22.27, where it has been patched.
How can this vulnerability impact me? :
The vulnerability can lead to stored XSS attacks, allowing attackers to execute malicious scripts in the context of other users, particularly staff members. This can result in theft of access and refresh tokens, potentially leading to unauthorized access to sensitive parts of the platform, compromising user accounts, and further exploitation of the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Saleor to one of the patched versions: 3.22.27, 3.21.43, or 3.20.108. If upgrading immediately is not possible, a possible workaround is to use a client-side HTML cleaner to sanitize rich text fields and prevent stored XSS attacks.