CVE-2026-22849 json
Saleor lacks proper HTML sanitization in rich text fields
published 2026-01-21 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-3777
- cvss
- 4.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.
Patch / fix
- saleor saleor 3.20.108, 3.21.43, 3.22.27
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected products
- saleor saleor
Classification
References
-
github.com
/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386
patch
-
github.com
/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b
patch
-
github.com
/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335
patch
-
github.com
/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee
patch
-
github.com
/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d
patch
-
github.com
/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv
vendor-advisory
-
docs.saleor.io
/security/#editorjs--html-cleaning
product
Sources
- CVE List CVE-2026-22849
- NVD CVE-2026-22849
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.