CVE-2026-10769: Drupal Commerce Core XSS Vulnerability

CVE-2026-10769 Overview

CVE-2026-10769 is a stored cross-site scripting (XSS) vulnerability in Drupal Commerce Core. The flaw stems from improper neutralization of user-controlled input during web page generation [CWE-79]. Attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of other users, including administrators.

The issue affects Drupal Commerce Core versions 3.3.0 through 3.3.6. Exploitation requires user interaction and results in a scope change, meaning payloads can impact resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can store malicious scripts that execute in victim browsers, enabling session theft, administrative action hijacking, and defacement of storefront pages.

Affected Products

Drupal Commerce Core 3.3.0
Drupal Commerce Core 3.3.x through 3.3.6
Drupal sites running the Commerce contributed module in the affected range

Discovery Timeline

2026-07-10 - CVE-2026-10769 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10769

Vulnerability Analysis

The vulnerability resides in the Drupal Commerce Core module, which powers e-commerce functionality on Drupal sites. Commerce Core fails to properly sanitize input before rendering it in generated web pages. An authenticated user with permission to submit content through Commerce Core interfaces can inject HTML or JavaScript that persists in the application's data store.

When a subsequent user loads a page containing the tainted content, the browser executes the injected script in the context of the site's origin. Because the vulnerability produces a scope change, injected code running in an administrator session can access resources and privileges that exceed those held by the original attacker.

Typical impact includes theft of session cookies, forced execution of privileged actions via forged requests, redirection to attacker infrastructure, and manipulation of order or checkout data displayed to customers.

Root Cause

The root cause is missing or insufficient output encoding when Commerce Core renders user-supplied fields into HTML. Drupal provides sanitization primitives such as Html::escape() and Twig auto-escaping, but the affected code paths in versions 3.3.0 through 3.3.6 do not apply them consistently to all rendered fields.

Attack Vector

The attack vector is network-based and requires an authenticated account with low privileges. The attacker submits a crafted payload through a Commerce Core input field. A victim must then view the page that renders the stored payload for the script to execute. See the Drupal Security Advisory for technical details on the affected fields and rendering paths.

Detection Methods for CVE-2026-10769

Indicators of Compromise

Stored Commerce entity fields containing <script>, onerror=, onload=, or javascript: sequences.
Unexpected outbound requests from administrator browsers to unfamiliar domains after viewing product, order, or checkout pages.
New or modified administrative accounts created shortly after low-privileged users edited Commerce content.

Detection Strategies

Scan the Drupal database for Commerce entity fields containing HTML tags or JavaScript event handlers that should not appear in product or order data.
Review web server access logs for POST requests from low-privileged accounts to Commerce administrative endpoints followed by administrator GET requests to the same resources.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts.

Monitoring Recommendations

Alert on Drupal watchdog log entries showing form submissions that contain HTML markup in text fields.
Monitor for anomalous session activity, such as administrator sessions performing bulk actions immediately after loading Commerce pages.
Track version strings for the commerce module across all Drupal sites and flag any instance in the 3.3.0–3.3.6 range.

How to Mitigate CVE-2026-10769

Immediate Actions Required

Upgrade Drupal Commerce Core to a version later than 3.3.6 as published in the vendor advisory.
Audit all Commerce entity content created during the exposure window and remove any embedded scripts or event handlers.
Rotate administrator session cookies and reset credentials for accounts that viewed potentially tainted pages.

Patch Information

Refer to the Drupal Security Advisory SA-CONTRIB-2026-041 for the fixed release of Commerce Core. Apply the update using Drupal's standard module update workflow and run database updates via drush updatedb after deployment.

Workarounds

Restrict the roles and permissions that allow submitting or editing Commerce content until the patch is applied.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources to reduce exploitability.
Place a web application firewall rule in front of Commerce administrative paths to block payloads containing script tags or JavaScript event handlers.

bash

# Configuration example: update Drupal Commerce via Composer and apply DB updates
composer update drupal/commerce --with-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild