CVE-2026-128029 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts does not escape catalog product import row errors on the Dataflow profile run page. An attacker who places markup in the store, type, or attribute_set columns of an import file can run script in the session of the administrator who runs the import.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts that use the Dataflow catalog product import feature in the admin area. Exposure depends on whether untrusted import files reach an admin user, since the attacker needs no account but the script runs in the admin's session. Sites that never import product files, or that run a fixed version, can skip it.
Not affected if fixed-version, no-catalog-import
Who cares magento-lts, openmage, php, self-hosted
20.18.2: move to 20.18.2.21.0.0-beta1 through 21.0.0-beta2: move to 21.0.0-beta3.OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.