CVE-2026-29175: Craftcms Craft Commerce XSS Vulnerability

CVE-2026-29175 Overview

CVE-2026-29175 is a stored Cross-Site Scripting (XSS) vulnerability affecting Craft Commerce, the ecommerce platform for Craft CMS. The vulnerability exists in the Commerce Inventory page where the Product Title, Variant Title, and Variant SKU fields are rendered without proper HTML escaping. This allows an attacker with authenticated access to inject malicious JavaScript that executes whenever any user, including administrators, views the inventory management page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of administrator sessions, potentially leading to account takeover, data theft, or further compromise of the ecommerce platform.

Affected Products

• Craft Commerce versions prior to 5.5.3
• craftcms craft_commerce (all affected versions)
• Craft CMS installations using the Commerce plugin

Discovery Timeline

• 2026-03-10 - CVE-2026-29175 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-29175

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) stems from improper neutralization of input during web page generation. When product or variant information is saved to the database, the application fails to sanitize user-supplied data in critical fields. Subsequently, when the Commerce Inventory page renders this data, it outputs the raw content directly into the HTML without proper encoding or escaping.

The attack requires authenticated access to the Commerce administration interface with permissions to create or modify products and variants. Once malicious payloads are stored in the Product Title, Variant Title, or Variant SKU fields, they persist in the database and execute every time the inventory page is loaded by any authenticated user.

The network-accessible nature of this vulnerability combined with the potential for high confidentiality and integrity impact makes this a significant security concern for organizations running vulnerable Craft Commerce installations.

Root Cause

The root cause is insufficient output encoding in the Commerce Inventory page template rendering logic. The application accepts user input for product and variant fields but fails to apply proper HTML entity encoding when displaying these values. This allows HTML and JavaScript content to be interpreted as executable code by the browser rather than being displayed as plain text.

Attack Vector

An attacker with low-privileged access to the Commerce administration panel can exploit this vulnerability through the following attack flow:

1. The attacker navigates to the product or variant creation/editing interface
2. Malicious JavaScript payloads are inserted into the Product Title, Variant Title, or Variant SKU fields
3. The payload is stored in the application database
4. When any user (including administrators) views the Commerce Inventory page, the stored payload executes in their browser session
5. The attacker can steal session cookies, perform actions on behalf of the victim, or redirect users to malicious sites

The vulnerability manifests in the inventory management template where field values are rendered without proper HTML escaping. The security advisory commit (9f0638a4fb29ed8295a463385a7cc49ec986e33a) implements proper output encoding to remediate this issue. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-29175

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in Product Title, Variant Title, or Variant SKU database fields
• Unexpected script execution or browser behavior when accessing the Commerce Inventory page
• Audit log entries showing modifications to product/variant fields with script-like content
• Reports from users about unexpected redirects or popups when viewing inventory pages

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Deploy Web Application Firewall (WAF) rules to monitor for XSS payload patterns in POST requests to product/variant endpoints
• Configure browser-based XSS auditing where available to identify potential injection attempts
• Review application logs for requests containing common XSS payloads targeting product management endpoints

Monitoring Recommendations

• Enable detailed logging for all product and variant modification operations
• Set up alerts for database entries containing HTML tags or JavaScript syntax in product-related fields
• Monitor for Content Security Policy violation reports that may indicate XSS exploitation attempts
• Implement regular security scanning of the Commerce administration interface

How to Mitigate CVE-2026-29175

Immediate Actions Required

• Upgrade Craft Commerce to version 5.5.3 or later immediately
• Audit existing product and variant data for malicious payloads in Title and SKU fields
• Review recent product/variant modification logs for suspicious activity
• Implement Content Security Policy headers as an additional defense layer

Patch Information

The vulnerability has been fixed in Craft Commerce version 5.5.3. The fix implements proper HTML escaping for the Product Title, Variant Title, and Variant SKU fields in the Commerce Inventory page templates. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed information about the fix, refer to the GitHub Commit and the GitHub Security Advisory.

Workarounds

• Restrict access to the Commerce administration panel to only trusted users until patching is complete
• Implement strict input validation at the application layer to reject HTML/script content in product fields
• Deploy a Web Application Firewall with XSS protection rules as a temporary mitigation measure
• Configure Content Security Policy headers to prevent inline script execution

# Example CSP header configuration for Nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;

# Example CSP header configuration for Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"