CVE-2026-22849

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.saleor.io/security/#editorjs--html-cleaning	Product
https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386	Patch
https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b	Patch
https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335	Patch
https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee	Patch
https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d	Patch
https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:saleor:saleor::::::::
	cpe:2.3:a:saleor:saleor::::::::
	cpe:2.3:a:saleor:saleor::::::::

History

No history.

Information

Published : 2026-01-21 22:15

Updated : 2026-01-29 18:17

NVD link : CVE-2026-22849

Mitre link : CVE-2026-22849

CVE.ORG link : CVE-2026-22849

JSON object : View

Products Affected

saleor

saleor

CWE

CWE-83

Improper Neutralization of Script in Attributes in a Web Page

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-22849", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-21T22:15:49.533", "references": [{"url": "https://docs.saleor.io/security/#editorjs--html-cleaning", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-83"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner."}], "lastModified": "2026-01-29T18:17:46.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F684302-13A5-4BD3-B546-3AB0297C0CF8", "versionEndExcluding": "3.20.108", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDC53D16-03D0-4360-B155-4EDE149A2C18", "versionEndExcluding": "3.21.43", "versionStartIncluding": "3.21.0"}, {"criteria": "cpe:2.3:a:saleor:saleor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7BCEDB3-50C9-46CC-A3A7-564F00D76570", "versionEndExcluding": "3.22.27", "versionStartIncluding": "3.22.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}