PT-2026-46113 · Drupal+2 · Commerce Core+2

Brian Willows + 5 · CVE-2026-10769 · Published 2026-06-03 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 3.3.0 through 3.3.6

Description Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the order receipt email template. This issue specifically affects installations where the commerce checkout module is enabled and the customer comments checkout pane is explicitly used, as this pane is disabled by default.

Recommendations Update Drupal Commerce Core to a version later than 3.3.6. As a temporary mitigation, disable the customer comments checkout pane.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-10769

DRUPAL-CONTRIB-2026-041

Affected Products

Commerce Core

Commerce

Drupal Commerce

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10769.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-10769 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10769 · Security Note
• https://git.drupalcode.org/project/commerce · Note
• https://drupal.org/project/commerce · Note
• https://drupal.org/sa-contrib-2026-041 · Note
• https://t.me/cveNotify/195856 · Telegram Post