CVE-2026-22849

Jan. 21, 2026, 10:15 p.m.

7.2
High

Description

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

Product(s) Impacted

Vendor Product Versions
Saleor
  • Saleor
  • 3.0.0-3.20.108, 3.21.43, 3.22.27

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-83
Improper Neutralization of Script in Attributes in a Web Page
The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a saleor saleor 3.0.0-3.20.108 / / / / / / /
a saleor saleor 3.21.43 / / / / / / /
a saleor saleor 3.22.27 / / / / / / /

References

https://docs.saleor.io/security/#editorjs--html-cleaning
https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d
https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv

Tags

[email protected]
CWE-83
2026-01-21
CVE-2026-22849

CVSS Score

7.2 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: PRESENT
  • Privileges Required: HIGH
  • User Interaction: PASSIVE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Jan. 21, 2026, 10:15 p.m.
Last Modified: Jan. 21, 2026, 10:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.