{"id":"CVE-2026-128029","kind":"vulnerability","aliases":["CVE-2026-128029"],"related":[],"title":"OpenMage magento-lts: stored XSS in Dataflow import errors runs admin scripts","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.","summary":"OpenMage magento-lts does not escape catalog product import row errors on the Dataflow profile run page. An attacker who places markup in the store, type, or attribute_set columns of an import file can run script in the session of the administrator who runs the import.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magento-lts","openmage","package","php","self-hosted"],"not_affected_if":["fixed-version","no-catalog-import"],"how_to_check":"- Check the installed magento-lts version in composer.lock or the OpenMage package manifest against the fixed versions below.\n- Look for the Dataflow profile run page under the admin area and confirm whether import files come from outside sources.","fix":"- magento-lts before `20.18.2`: move to `20.18.2`.\n- magento-lts `21.0.0-beta1` through `21.0.0-beta2`: move to `21.0.0-beta3`.","status":"open","published_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:58:44+00:00","updated_at":"2026-11-13T10:58:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:58:44Z","model":"claude-haiku-5-5","output":{"fix":"- magento-lts before `20.18.2`: move to `20.18.2`.\n- magento-lts `21.0.0-beta1` through `21.0.0-beta2`: move to `21.0.0-beta3`.","reach":"internet","title":"OpenMage magento-lts: stored XSS in Dataflow import errors runs admin scripts","impact":"medium","summary":"OpenMage magento-lts does not escape catalog product import row errors on the Dataflow profile run page. An attacker who places markup in the store, type, or attribute_set columns of an import file can run script in the session of the administrator who runs the import.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento-lts","openmage","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"script runs in an administrator's session and can act as them","analyst_note":"","how_to_check":"- Check the installed magento-lts version in composer.lock or the OpenMage package manifest against the fixed versions below.\n- Look for the Dataflow profile run page under the admin area and confirm whether import files come from outside sources.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-catalog-import"],"who_is_affected":"Stores running OpenMage magento-lts that use the Dataflow catalog product import feature in the admin area. Exposure depends on whether untrusted import files reach an admin user, since the attacker needs no account but the script runs in the admin's session. Sites that never import product files, or that run a fixed version, can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4662,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128029':16A,19A '-2026':15A,18A '20.18.2':82C '21.0.0':84C,87C 'admin':12A 'administr':72B,140C 'attack':48B,116C 'attribut':57B,125C 'beta1':85C 'beta3':88C 'catalog':36B,105C 'column':59B,127C 'contain':89C 'cross':93C 'cross-sit':92C 'cve':14A,17A 'dataflow':8A,43B,99C 'error':10A,40B,109C 'escap':35B,114C 'file':63B,131C 'host':28B 'import':9A,38B,62B,76B,107C,130C,142C 'insert':104C 'lts':4A,22B,32B,80C 'magento':3A,21B,31B,79C 'magento-lt':2A,20B,30B,78C 'markup':51B,119C 'openmag':1A,23B,29B,77C 'packag':24B 'page':46B,102C,112C 'php':25B 'place':50B,118C 'product':37B,106C 'profil':44B,100C 'row':39B,108C 'run':11A,45B,65B,74B,101C,133C 'script':13A,66B,95C,134C 'self':27B 'self-host':26B 'session':69B,137C 'set':58B,126C 'site':94C 'store':5A,54B,91C,122C 'type':55B,123C 'unauthent':115C 'vulner':96C 'without':113C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts that use the Dataflow catalog product import feature in the admin area. Exposure depends on whether untrusted import files reach an admin user, since the attacker needs no account but the script runs in the admin's session. Sites that never import product files, or that run a fixed version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["magentolts","medium","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128029':16A,19A '-2026':15A,18A 'admin':12A 'cve':14A,17A 'dataflow':8A 'error':10A 'import':9A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'run':11A 'script':13A 'store':5A 'xss':6A","search_b":"'administr':72B 'attack':48B 'attribut':57B 'catalog':36B 'column':59B 'dataflow':43B 'error':40B 'escap':35B 'file':63B 'host':28B 'import':38B,62B,76B 'lts':22B,32B 'magento':21B,31B 'magento-lt':20B,30B 'markup':51B 'openmag':23B,29B 'packag':24B 'page':46B 'php':25B 'place':50B 'product':37B 'profil':44B 'row':39B 'run':45B,65B,74B 'script':66B 'self':27B 'self-host':26B 'session':69B 'set':58B 'store':54B 'type':55B","search_c":"'20.18.2':82C '21.0.0':84C,87C 'administr':140C 'attack':116C 'attribut':125C 'beta1':85C 'beta3':88C 'catalog':105C 'column':127C 'contain':89C 'cross':93C 'cross-sit':92C 'dataflow':99C 'error':109C 'escap':114C 'file':131C 'import':107C,130C,142C 'insert':104C 'lts':80C 'magento':79C 'magento-lt':78C 'markup':119C 'openmag':77C 'page':102C,112C 'place':118C 'product':106C 'profil':100C 'row':108C 'run':101C,133C 'script':95C,134C 'session':137C 'set':126C 'site':94C 'store':91C,122C 'type':123C 'unauthent':115C 'vulner':96C 'without':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T20:00:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128029","severity":null,"published_at":"2026-11-13T10:18:08+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145361,"url":"https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145362,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T20:00:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145363,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}