CVE-2026-71803: money-pos 1.0 Stored XSS Vulnerability

CVE-2026-71803 Overview

CVE-2026-71803 is a stored Cross-Site Scripting (XSS) vulnerability in money-pos 1.0. The flaw affects the returns processing workflow, where the backend fails to sanitize the goodsName parameter before concatenating it into order log descriptions. The frontend then renders this attacker-controlled content using Vue.js v-html, which bypasses default HTML escaping. An attacker with product creation privileges can inject JavaScript that executes in an administrator's browser session when order logs are viewed.

Critical Impact

Authenticated attackers with product creation rights can execute arbitrary JavaScript in administrator sessions, enabling session hijacking, privileged actions, and further compromise of the point-of-sale environment.

Affected Products

• money-pos version 1.0
• Backend returns processing component (order log generator)
• Frontend order log viewer using Vue.js v-html directive

Discovery Timeline

• 2026-09-09 - CVE-2026-71803 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71803

Vulnerability Analysis

The vulnerability is a stored XSS [CWE-79] that spans both server and client tiers of money-pos 1.0. When a return transaction is processed, the backend takes the goodsName field from the associated product record and concatenates it directly into a human-readable order log description. No HTML entity encoding or input filtering is applied at write time.

When an administrator later opens the order log view, the frontend binds the stored description to the DOM using Vue's v-html directive. This directive renders raw HTML and executes any embedded <script> blocks or event handlers. Because the injection is persistent, every administrator viewing the affected log triggers the payload.

Root Cause

The root cause is missing output encoding combined with an unsafe rendering primitive. The backend trusts goodsName as safe display data and performs string concatenation instead of contextual escaping. The frontend compounds the flaw by using v-html rather than standard mustache interpolation, which would otherwise escape HTML entities.

Attack Vector

Exploitation requires an authenticated account with product creation privileges. The attacker creates a product whose goodsName field contains a JavaScript payload, for example an <img> tag with an onerror handler or a <script> block. The attacker then initiates a return operation for that product, causing the backend to write the malicious string into the order log. When any administrator opens the order logs view, the payload executes in the administrator's authenticated context.

Refer to the GitHub Vulnerability Issue #7 for the original proof-of-concept and reproduction steps.

Detection Methods for CVE-2026-71803

Indicators of Compromise

• Product records whose goodsName field contains HTML tags, <script>, on* event handlers, or javascript: URIs
• Order log entries with unexpected markup, encoded characters, or references to external script sources
• Outbound requests from administrator browsers to unfamiliar domains shortly after opening the order log view
• Anomalous session activity from administrator accounts following log review, such as new user creation or configuration changes

Detection Strategies

• Query the product database for goodsName values matching regex patterns for HTML or JavaScript syntax
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts in the admin console
• Review web server access logs for administrator sessions that immediately preceded suspicious API calls

Monitoring Recommendations

• Alert on creation or modification of product records containing angle brackets or script keywords in name fields
• Monitor administrator browser sessions for unexpected DOM mutations or script loads originating from the order log page
• Correlate return transactions with subsequent privileged actions performed by administrator accounts

How to Mitigate CVE-2026-71803

Immediate Actions Required

• Audit all existing goodsName values and quarantine any records containing HTML or script syntax
• Restrict product creation privileges to trusted operators until a patched build is deployed
• Replace the frontend v-html binding on the order log description with standard text interpolation
• Add server-side HTML entity encoding to goodsName before it is written into any log description

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the upstream project via the GitHub Vulnerability Issue #7 for remediation updates. Until an official fix is available, apply the code-level workarounds below.

Workarounds

• Change the Vue template from v-html="log.description" to {{ log.description }} so the framework escapes HTML entities by default
• Apply a sanitization library such as DOMPurify to any field that must render rich content
• Enforce a strict Content Security Policy that disallows unsafe-inline scripts in the administrator interface
• Validate goodsName on input with an allow-list of alphanumeric characters, spaces, and business-relevant punctuation

# Example CSP header to block inline script execution in the admin console
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'