CVE-2026-128029

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-128029", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-12T20:33:43.125Z", "datePublished": "2026-11-13T09:34:01.768Z", "dateUpdated": "2026-11-13T09:34:01.768Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-13T09:34:01.768Z"}, "datePublic": "2026-10-26T00:00:00.000Z", "title": "OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors", "descriptions": [{"lang": "en", "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "OpenMage", "product": "magento-lts", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "20.18.2"}, {"version": "20.18.2", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "OpenMage", "product": "magento-lts", "defaultStatus": "unaffected", "versions": [{"version": "21.0.0-beta1", "status": "affected", "versionType": "semver", "lessThan": "21.0.0-beta3"}, {"version": "21.0.0-beta3", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-28hq-mq6h-fh2x)"}, {"url": "https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de", "tags": ["patch"], "name": "Patch Commit"}, {"name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors"}], "credits": [{"lang": "en", "value": "colinmollenhour", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "magento-lts", "vendor": "OpenMage", "versions": [{"lessThan": "20.18.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "20.18.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "magento-lts", "vendor": "OpenMage", "versions": [{"lessThan": "21.0.0-beta3", "status": "affected", "version": "21.0.0-beta1", "versionType": "semver"}, {"status": "unaffected", "version": "21.0.0-beta3", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it."}], "id": "CVE-2026-128029", "lastModified": "2026-11-13T10:18:08.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-13T10:18:08.850", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{}