{"id":"CVE-2026-118560","kind":"vulnerability","aliases":["CVE-2026-118560"],"related":[],"title":"Drupal Commerce Stripe: cross-site scripting flaw in versions 2.0.0 to 2.2.3","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS). This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.","summary":"Drupal Commerce Stripe, a payment module for Drupal stores, has a cross-site scripting flaw in versions 2.0.0 through 2.2.3. An attacker can inject script into pages the module generates, which runs in a visitor's browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["commerce-stripe","drupal","ecommerce","package"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Commerce Stripe version in the Drupal project (for example with `composer show drupal/commerce_stripe`) and see whether it falls in `2.0.0` to `2.2.3`.","fix":"- Commerce Stripe: move to a version later than `2.2.3`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:17+00:00","updated_at":"2026-10-30T04:29:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- Commerce Stripe: move to a version later than `2.2.3`; the sources do not name the exact fixed release.","reach":"internet","title":"Drupal Commerce Stripe: cross-site scripting flaw in versions 2.0.0 to 2.2.3","impact":"medium","summary":"Drupal Commerce Stripe, a payment module for Drupal stores, has a cross-site scripting flaw in versions 2.0.0 through 2.2.3. An attacker can inject script into pages the module generates, which runs in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","commerce-stripe","ecommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the store site","analyst_note":"Confirm the fixed version and whether exploitation needs authentication or specific input; the NVD entry alone gives no severity or fix version.","how_to_check":"- Check the installed Commerce Stripe version in the Drupal project (for example with `composer show drupal/commerce_stripe`) and see whether it falls in `2.0.0` to `2.2.3`.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the Commerce Stripe module in the affected range are exposed, since the flaw is in pages the module builds. Sites that do not use Commerce Stripe can skip it. The sources do not say whether a logged-in user or special configuration is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4120,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118560':16A,19A '-2026':15A,18A '2.0.0':11A,44B,94C '2.2.3':13A,46B,96C 'affect':89C 'allow':81C 'attack':48B 'browser':63B 'commerc':2A,21B,27B,79C,90C 'commerce-strip':20B 'cross':5A,38B,73C,83C 'cross-sit':4A,37B,72C,82C 'cve':14A,17A 'drupal':1A,23B,26B,33B,78C 'ecommerc':24B 'flaw':8A,41B 'generat':56B,71C 'improp':64C 'inject':50B 'input':67C 'issu':88C 'modul':31B,55B 'neutral':65C 'packag':25B 'page':53B,70C 'payment':30B 'run':58B 'script':7A,40B,51B,75C,85C 'site':6A,39B,74C,84C 'store':34B 'stripe':3A,22B,28B,80C,91C 'version':10A,43B,92C 'visitor':61B 'vulner':76C 'web':69C 'xss':86C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the Commerce Stripe module in the affected range are exposed, since the flaw is in pages the module builds. Sites that do not use Commerce Stripe can skip it. The sources do not say whether a logged-in user or special configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118560","severity":null,"published_at":"2026-10-30T04:18:21+00:00","modified_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}