← Vulnerability feed

Vulnerability record · CVE-2026-22849 · published 21 January 2026

CVE-2026-22849: Saleor cross-site scripting vulnerability

Saleor · Saleor

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

7.2 CVSS 4.0 High EPSS 0.24% · top 86.4% CWE-83 · CWE-83CWE-79 · Cross-site scripting
7.2CVSS 4.0 base score
0.24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
17 Jun 2026Last modified by NVD

Description

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://docs.saleor.io/security/#editorjs--html-cleaning Product
https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386 Patch
https://github.com/saleor/saleor/commit/676d95dbc7d811610e68f2ea8f9b6652cbd58e9b Patch
https://github.com/saleor/saleor/commit/9110eba68c3f73afa1f72b45bd9b1394c752d335 Patch
https://github.com/saleor/saleor/commit/b67a0b9d9f243e5d6c2f9c7643d42a54c24c90ee Patch
https://github.com/saleor/saleor/commit/bb5f883aeb0f085899a9d4f35d429cf7eb07a11d Patch
https://github.com/saleor/saleor/security/advisories/GHSA-8jcj-r5g2-qrpv Vendor Advisory

Track CVE-2026-22849 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-24136Saleor insecure direct object reference vulnerabilitySaleor is an e-commerce platform. Versions 3.2.0 through 3.20.109, 3.21.0-a.0 through 3.21.44 and 3.22.0-a.0 through 3.22.28 have a n Insecure Direct…EPSS 0.41%8.5CVE-2026-23499Saleor cross-site scripting vulnerabilitySaleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff …EPSS 0.27%7.5CVE-2026-35401Saleor allocation without limits vulnerabilitySaleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations…EPSS 0.46%7.5CVE-2026-33756Saleor allocation without limits vulnerabilitySaleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, Saleor supports query batching by submitting multipl…EPSS 0.79%6.5CVE-2022-0932Saleor missing authorization vulnerabilityMissing Authorization in GitHub repository saleor/saleor prior to 3.1.2.EPSS 1.0%5.9CVE-2026-35407Saleor improper authorization vulnerabilitySaleor is an e-commerce platform. From 2.10.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a business-logic and authorization flaw was found i…EPSS 0.41%5.4CVE-2024-31205Saleor cross-site request forgery vulnerabilitySaleor is an e-commerce platform. Starting in version 3.10.0 and prior to versions 3.14.64, 3.15.39, 3.16.39, 3.17.35, 3.18.31, and 3.19.19, an attac…EPSS 0.19%5.4CVE-2024-29888Saleor vulnerabilitySaleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in s…EPSS 0.53%

Source: NIST National Vulnerability Database (record CVE-2026-22849), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.