CVE-2026-22849

HIGH EPSS 10.2%
Published Jan 21, 20265mo ago · Modified Jun 17, 20262w ago
7.2 CVSS 4.0
High
Find Similar
Published Jan 21, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

CVSS Details

Base Score
7.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
10.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-83

Affected Products 3

VendorProductVersionRange
saleorsaleor*≥3.0.0  –  <3.20.108
saleorsaleor*≥3.21.0  –  <3.21.43
saleorsaleor*≥3.22.0  –  <3.22.27

References 7

  • docs.saleor.io https://docs.saleor.io/security/#editorjs--html-cleaning
    Product
  • github.com https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
    Patch
  • github.com https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
    Patch
  • github.com https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
    Patch
  • github.com https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
    Patch
  • github.com https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d
    Patch
  • github.com https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv
    Vendor Advisory

Remediation

  • github.com https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
    Patch
  • github.com https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
    Patch
  • github.com https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
    Patch
  • github.com https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
    Patch
  • github.com https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d
    Patch