CVE-2026-22849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22849", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-12T16:20:16.745Z", "datePublished": "2026-01-21T21:31:14.664Z", "dateUpdated": "2026-01-22T16:50:18.828Z"}, "containers": {"cna": {"title": "Saleor lacks proper HTML sanitization in rich text fields", "problemTypes": [{"descriptions": [{"cweId": "CWE-83", "lang": "en", "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv"}, {"name": "https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386"}, {"name": "https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b"}, {"name": "https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335"}, {"name": "https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee"}, {"name": "https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d", "tags": ["x_refsource_MISC"], "url": "https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d"}, {"name": "https://docs.saleor.io/security/#editorjs--html-cleaning", "tags": ["x_refsource_MISC"], "url": "https://docs.saleor.io/security/#editorjs--html-cleaning"}], "affected": [{"vendor": "saleor", "product": "saleor", "versions": [{"version": ">= 3.2.0, < 3.22.27", "status": "affected"}, {"version": ">= 3.1.0, < 3.21.43", "status": "affected"}, {"version": ">= 3.0.0, < 3.20.108", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:31:14.664Z"}, "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner."}], "source": {"advisory": "GHSA-8jcj-r5g2-qrpv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:09:35.969984Z", "id": "CVE-2026-22849", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:50:18.828Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T15:09:35.969984Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:09:37.102Z"}}], "cna": {"title": "Saleor lacks proper HTML sanitization in rich text fields", "source": {"advisory": "GHSA-8jcj-r5g2-qrpv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "saleor", "product": "saleor", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.22.27"}, {"status": "affected", "version": ">= 3.1.0, < 3.21.43"}, {"status": "affected", "version": ">= 3.0.0, < 3.20.108"}]}], "references": [{"url": "https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv", "name": "https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386", "name": "https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b", "name": "https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335", "name": "https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee", "name": "https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d", "name": "https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d", "tags": ["x_refsource_MISC"]}, {"url": "https://docs.saleor.io/security/#editorjs--html-cleaning", "name": "https://docs.saleor.io/security/#editorjs--html-cleaning", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-83", "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:31:14.664Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22849", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:50:18.828Z", "dateReserved": "2026-01-12T16:20:16.745Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T21:31:14.664Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "saleor", "vendor": "saleor", "versions": [{"status": "affected", "version": ">= 3.2.0, < 3.22.27"}, {"status": "affected", "version": ">= 3.1.0, < 3.21.43"}, {"status": "affected", "version": ">= 3.0.0, < 3.20.108"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F684302-13A5-4BD3-B546-3AB0297C0CF8", "versionEndExcluding": "3.20.108", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDC53D16-03D0-4360-B155-4EDE149A2C18", "versionEndExcluding": "3.21.43", "versionStartIncluding": "3.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7BCEDB3-50C9-46CC-A3A7-564F00D76570", "versionEndExcluding": "3.22.27", "versionStartIncluding": "3.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner."}, {"lang": "es", "value": "Saleor es una plataforma de comercio electr\u00f3nico. A partir de la versi\u00f3n 3.0.0 y antes de las versiones 3.20.108, 3.21.43 y 3.22.27, Saleor permit\u00eda a los usuarios modificar campos de texto enriquecido con HTML sin ejecutar ning\u00fan limpiador HTML de backend, lo que permit\u00eda a actores maliciosos realizar ataques de XSS almacenado en paneles de control y escaparates. Miembros del personal maliciosos pod\u00edan crear inyecciones de scripts para atacar a otros miembros del personal, posiblemente robando sus tokens de acceso y/o de actualizaci\u00f3n. Este problema ha sido parcheado en las versiones 3.22.27, 3.21.43 y 3.20.108. En caso de no poder actualizar de inmediato, una posible soluci\u00f3n alternativa es usar un limpiador del lado del cliente."}], "id": "CVE-2026-22849", "lastModified": "2026-06-17T10:20:29.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22849", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T15:09:35.969984Z", "version": "2.0.3"}}]}, "published": "2026-01-21T22:15:49.533", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://docs.saleor.io/security/#editorjs--html-cleaning"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-83"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:10:07.825032+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest patched Saleor release (\u22653.22.27, \u22653.21.43, or \u22653.20.108).", "If upgrading is not feasible immediately, implement a client\u2011side sanitizer for rich\u2011text fields (for example, using Editor.js with DOMPurify).", "Restrict rich\u2011text editing privileges to trusted staff and enforce role\u2011based access controls to minimize the attack surface."], "summary": {"action": "Patch immediately", "impact": "Stored Cross\u2011Site Scripting on dashboards and storefronts, enabling theft of staff session tokens"}, "threat_synthesis": {"affected_systems": "The flaw is present in the Saleor e\u2011commerce platform released between the start of version 3.0.0 and the following unpatched release points: 3.20.107, 3.21.42, and 3.22.26. It does not affect later releases 3.20.108, 3.21.43, or 3.22.27 and any subsequent versions. Affected deployments use the saleor:CPE base cpe:2.3:a:saleor:saleor.", "description_and_impact": "This vulnerability allows malicious code to be stored in Saleor rich\u2011text fields without server\u2011side sanitization, giving rise to stored cross\u2011site scripting. When the CMS renders these fields on dashboards or storefronts, injected scripts execute in the browsers of any user viewing the content, potentially stealing session or refresh tokens of privileged staff and compromising the backend. The weakness stems from improper HTML cleaning, corresponding to CWE\u201179 and CWE\u201183.", "risk_and_exploitability": "The CVSS score of 7.2 indicates high risk; the EPSS score below 1% suggests the probability of a publicly available exploit is low, and it has not been listed in CISA\u2019s KEV catalog. However, since the attack vector requires authenticated access to rich\u2011text editing privileges, the risk is limited to insiders or compromised accounts. The lack of mitigation means a successful attack could lead to credential theft and possible full\u2011control takeover of the platform."}}}}, "created": "2026-01-22T10:08:36.191884+00:00", "updated": "2026-04-18T04:15:05.877301+00:00", "vendors": ["saleor", "saleor$PRODUCT$saleor"]}