Saleor lacks proper HTML sanitization in rich text fields
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| saleor | saleor | 3.2.0 to before 3.22.27; 3.1.0 to before 3.21.43; 3.0.0 to before 3.20.108 | 3.22.27, 3.21.43, 3.20.108 | Patch available | CNA |
- saleor Vendorsaleor Affected 3.2.0 to before 3.22.27; 3.1.0 to before 3.21.43; 3.0.0 to before 3.20.108 Fixed in 3.22.27, 3.21.43, 3.20.108 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:* | 3.0.0 to before 3.20.108; 3.21.0 to before 3.21.43; 3.22.0 to before 3.22.27 | Vulnerable | saleor |
- cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.20.108; 3.21.0 to before 3.21.43; 3.22.0 to before 3.22.27 Vulnerable ·saleor
Remediation
- Fix · CNA saleor (saleor) Fixed in 3.22.27, 3.21.43, 3.20.108
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22849
References
Patch 5
- https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
- https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
- https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
- https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
- https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d
More Saleor vulnerabilities
- TI-2026-19454 Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API CVSS 4.0HIGH 8.7
- TI-2026-27537 Saleor has a resource exhaustion vulnerability in GraphQL queries CVSS 3.1HIGH 7.5
- TI-2026-26135 Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching CVSS 3.1HIGH 7.5
- TI-2026-18932 Saleor vulnerable to stored XSS via Unrestricted File Upload CVSS 4.0HIGH 8.5
- TI-2022-18651 Improper object type validation in saleor CVSS 3.1MEDIUM 5.3
- TI-2022-00832 Missing Authorization in saleor/saleor CVSS 3.1MEDIUM 6.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences