CVE-2026-84438: OpenCart Cross-Site Scripting Vulnerability

CVE-2026-84438 Overview

CVE-2026-84438 is a stored cross-site scripting (XSS) vulnerability affecting OpenCart versions 4.1.0.3 and 4.1.0.4. The flaw resides in the catalog/controller/account/edit.php file within the Autocomplete Workflow component. Attackers can manipulate the firstname argument to inject malicious script content that executes in the context of other users' browsers. The vulnerability is exploitable remotely and requires low-privilege authenticated access. The exploit has been publicly disclosed on GitHub, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads through the customer profile firstname field, enabling session theft, credential harvesting, and administrative account compromise when the payload renders in privileged contexts.

Affected Products

• OpenCart 4.1.0.3
• OpenCart 4.1.0.4
• Autocomplete Workflow component in catalog/controller/account/edit.php

Discovery Timeline

• 2026-09-02 - CVE-2026-84438 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84438

Vulnerability Analysis

The vulnerability exists in the account edit workflow of OpenCart 4.1.0.3 and 4.1.0.4. When a customer submits profile updates through catalog/controller/account/edit.php, the firstname parameter is stored without adequate output encoding. The stored value is later reflected in the Autocomplete Workflow component, where it renders as raw HTML in the response. Any browser rendering the affected page executes attacker-controlled JavaScript in the victim's session context. Because the payload persists in the database, exploitation does not require social engineering on each visit.

Root Cause

The root cause is improper neutralization of user-supplied input before it is included in HTML output [CWE-79]. The firstname field lacks server-side sanitization and output-time escaping. OpenCart's template rendering path does not enforce contextual encoding for this attribute, so injected <script> tags and event handlers survive the round trip from storage to rendered response.

Attack Vector

Exploitation requires network access and an authenticated OpenCart customer account with permission to edit profile data. The attacker submits a crafted firstname value containing a JavaScript payload through the account edit form. When any user, including administrators, triggers the Autocomplete Workflow that references the stored name, the payload executes. Successful exploitation can hijack sessions, exfiltrate cookies, perform actions on behalf of the victim, or pivot to administrator account takeover if a staff user views the malicious record.

The vulnerability mechanism is documented in the public proof-of-concept. See the GitHub PoC for OpenCart XSS and the VulDB CVE-2026-84438 Details entry for technical specifics.

Detection Methods for CVE-2026-84438

Indicators of Compromise

• Customer records where the firstname field contains HTML tags, <script>, onerror=, onload=, or javascript: substrings.
• Web server access logs showing POST requests to index.php?route=account/edit with encoded angle brackets or script keywords in the firstname parameter.
• Outbound HTTP requests from staff browsers to unexpected domains shortly after viewing customer records in the OpenCart admin panel.

Detection Strategies

• Query the OpenCart oc_customer table for firstname values matching regular expressions that identify HTML or JavaScript syntax.
• Deploy a Web Application Firewall (WAF) rule that inspects account edit submissions for script tags and event handler attributes.
• Enable Content Security Policy (CSP) reporting to capture violations when injected scripts attempt to execute in the storefront or admin UI.

Monitoring Recommendations

• Alert on repeated profile edits from the same customer session within short time windows, which may indicate payload iteration.
• Correlate admin panel page views of customer detail pages with anomalous outbound network activity from admin workstations.
• Track CSP violation reports and browser error telemetry for the storefront domain to surface active injection attempts.

How to Mitigate CVE-2026-84438

Immediate Actions Required

• Audit the customer database for firstname values containing HTML or JavaScript syntax and sanitize or purge any suspicious entries.
• Restrict access to the OpenCart admin panel to trusted networks until a patch is available, reducing exposure of privileged users to stored payloads.
• Deploy a WAF rule that blocks account edit requests containing script tags, event handler attributes, or javascript: URIs in the firstname parameter.

Patch Information

The vendor was contacted but did not respond to the disclosure. No official patch is available at the time of publication. Administrators should track the VulDB Vulnerability #397802 entry and the OpenCart project release notes for future fixes. Until an official update ships, apply the workarounds below and consider a temporary code-level fix that HTML-encodes the firstname field on both input and output.

Workarounds

• Modify catalog/controller/account/edit.php to validate firstname against an allow-list of characters, such as letters, spaces, apostrophes, and hyphens.
• Apply htmlspecialchars($firstname, ENT_QUOTES, 'UTF-8') when rendering the value in Twig templates or PHP output paths used by the Autocomplete Workflow.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins on both storefront and admin domains.

# Example CSP header to reduce stored XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"