Cross-site scripting in magento-lts - #VU158612
Published: November 2, 2026
Vulnerability identifier: #VU158612
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script in an importing administrator's browser in the adminhtml origin.
The vulnerability exists due to improper escaping of batch import row error messages in the Dataflow profile runner's system/convert/profile/process.phtml template when rendering errors containing imported row values. A remote attacker can supply a crafted import file containing script-bearing markup in the store, type, or attribute_set columns and induce an administrator to run a Dataflow import profile on it to execute script with the importing administrator's session and form key.
Affected software
magento-lts
Remediation
Install security update from vendor's website.
magento-lts - addressed in versions 20.18.2, 20.19.0, 21.0.0 beta3