PT-2026-3866 · Saleor · Saleor

Lukasz-Rybak · Published 2026-01-21 · Updated 2026-01-21 · CVE-2026-22849

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Saleor versions 3.0.0 through 3.20.107 Saleor versions 3.21.0 through 3.21.42 Saleor versions 3.22.0 through 3.22.26

Description Saleor, an e-commerce platform, permitted modification of rich text fields with HTML without backend sanitization. This allowed malicious actors to execute stored cross-site scripting (XSS) attacks on both dashboards and storefronts. Specifically, malicious staff members could inject scripts to target other staff members, potentially compromising their access and refresh tokens. The issue impacts the ability to properly handle HTML input in rich text fields, potentially leading to unauthorized code execution within the platform.

Recommendations Upgrade to Saleor version 3.20.108 or later. Upgrade to Saleor version 3.21.43 or later. Upgrade to Saleor version 3.22.27 or later. As a temporary workaround, implement a client-side HTML cleaner.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-83

Related Identifiers

CVE-2026-22849

GHSA-8JCJ-R5G2-QRPV

Affected Products

Saleor

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22849.json · Exploit
• https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b · Patch
• https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386 · Patch
• https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d · Patch
• https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv · Vendor Advisory
• https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335 · Patch
• https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee · Patch
• https://osv.dev/vulnerability/CVE-2026-22849 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22849 · Security Note
• https://twitter.com/CVEnew/status/2014095563826880930 · Twitter Post
• https://t.me/CVEtracker/42697 · Telegram Post
• https://docs.saleor.io/security/#editorjs--html-cleaning · Note
• https://twitter.com/VulmonFeeds/status/2014125669567922301 · Twitter Post