CVE-2026-11975: SimplCommerce Stored XSS Vulnerability

CVE-2026-11975 Overview

CVE-2026-11975 is a stored cross-site scripting (XSS) vulnerability in the NewsItemApiController of SimplCommerce, an open-source ASP.NET Core e-commerce platform. The flaw exists in commits prior to 6142d3b5 and allows an authenticated administrator to inject arbitrary JavaScript through the ShortContent and FullContent fields of news items. The application stores these inputs without HTML sanitization and later renders them unencoded through @Html.Raw(), causing script execution in the browser of any user viewing the affected news content. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated administrator can persist malicious JavaScript that executes in the context of every visitor rendering the affected news item, enabling session theft, administrative action hijacking, and pivoting to other users.

Affected Products

SimplCommerce (News module, NewsItemApiController)
All SimplCommerce builds prior to commit 6142d3b5147899e0edb41663ae20183878ab39f7
Deployments rendering news content via @Html.Raw() in Razor views

Discovery Timeline

2026-06-17 - CVE-2026-11975 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11975

Vulnerability Analysis

The NewsItemApiController exposes create and update endpoints for news items in the SimplCommerce News module. The controller accepts ShortContent and FullContent payloads from authenticated administrators and persists them directly to the database. When these fields are rendered in Razor views using @Html.Raw(), the framework emits the stored markup without HTML encoding. An attacker with administrative credentials can therefore embed <script> tags or event-handler attributes that execute on every page load.

Because the payload is stored, the script triggers for every subsequent visitor who views the affected news item. Although exploitation requires high privileges, the injected script runs in the security context of any authenticated user, including other administrators. This enables session hijacking, CSRF token theft, and arbitrary actions against the admin API.

Root Cause

The root cause is missing server-side HTML sanitization combined with unencoded output rendering. The controller trusts authenticated administrator input as safe HTML, and the view layer reinforces that assumption by using @Html.Raw(). There is no allow-list of permitted tags or attributes, so any active content survives the request-to-render lifecycle intact.

Attack Vector

An authenticated administrator submits a news item containing JavaScript in ShortContent or FullContent through the news API. The payload is persisted unchanged. When the news item is rendered, the script executes in the browser of every user who loads the page, including higher-privileged administrators visiting the same admin views.

text

// Patch excerpt from NewsItemApiController.cs
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
+using Ganss.Xss;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;

Source: SimplCommerce commit 6142d3b5. The patch introduces the Ganss.Xss HtmlSanitizer library to strip dangerous markup before persistence.

Detection Methods for CVE-2026-11975

Indicators of Compromise

News items whose ShortContent or FullContent columns contain <script> tags, javascript: URIs, or inline event handlers such as onerror= and onload=.
Outbound requests from administrator browsers to unexpected domains shortly after loading news pages.
Unexpected creation or modification of admin user accounts following news item rendering.

Detection Strategies

Query the news database tables for HTML control characters and known XSS sink patterns in ShortContent and FullContent.
Inspect web server logs for POST and PUT requests to NewsItemApiController endpoints carrying script-like payloads.
Add Content Security Policy (CSP) violation reporting to capture inline script execution in admin views.

Monitoring Recommendations

Alert on administrative session activity that originates from new IP addresses immediately after news item updates.
Monitor browser telemetry on admin endpoints for execution of inline scripts in Razor-rendered pages.
Review audit logs of the News module for edits made by service or low-activity administrator accounts.

How to Mitigate CVE-2026-11975

Immediate Actions Required

Update SimplCommerce to a build that includes commit 6142d3b5147899e0edb41663ae20183878ab39f7 or later.
Audit existing news items and remove or sanitize any records containing active HTML content.
Rotate administrative session cookies and credentials if untrusted content was published before patching.

Patch Information

The fix is delivered in SimplCommerce commit 6142d3b5, which adds the Ganss.Xss HtmlSanitizer to NewsItemApiController and sanitizes ShortContent and FullContent before they are stored. The associated discussion is available in SimplCommerce pull request #1151.

Workarounds

Restrict access to the News module to a minimal set of trusted administrator accounts until the patch is deployed.
Replace @Html.Raw() usage for news content with @Html.Encode() or equivalent encoded output in custom forks.
Deploy a strict Content Security Policy that blocks inline scripts on admin and storefront pages rendering news content.

bash

# Example CSP header to block inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;