Live › vulnerability › CVE-2026-118558
Drupal Commerce Stripe versions 2.0.0 through 2.2.3 contain a cross-site request forgery flaw. A malicious web page can make a logged-in user's browser send requests to the site without their knowledge.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that use the Commerce Stripe module between versions 2.0.0 and 2.2.3 are exposed. The risk applies to the storefront and admin actions that Stripe-related forms accept from logged-in users. Sites not running this module, or running a version outside that range, are not affected by this description.
No product ranges from the sources yet.
composer show drupal/commerce_stripedrupal/commerce_stripe in composer.lock2.2.3; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-118558")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.