---
id: "CVE-2026-128029"
page: "https://infrastack.ai/live/CVE-2026-128029"
kind: "vulnerability"
aliases: ["CVE-2026-128029"]
title: "OpenMage magento-lts: stored XSS in Dataflow import errors runs admin scripts"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["magento-lts", "openmage", "package", "php", "self-hosted"]
not_affected_if: ["fixed-version", "no-catalog-import"]
published_at: "2026-11-13T10:18:08+00:00"
first_seen_at: "2026-11-13T10:47:31+00:00"
updated_at: "2026-11-13T10:58:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128029", "first_seen_at": "2026-11-13T10:47:31+00:00"}]
exploit_sources: []
---

# OpenMage magento-lts: stored XSS in Dataflow import errors runs admin scripts

Link for people: https://infrastack.ai/live/CVE-2026-128029 (this .md is for agents)

OpenMage magento-lts does not escape catalog product import row errors on the Dataflow profile run page. An attacker who places markup in the store, type, or attribute_set columns of an import file can run script in the session of the administrator who runs the import.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed magento-lts version in composer.lock or the OpenMage package manifest against the fixed versions below.
- Look for the Dataflow profile run page under the admin area and confirm whether import files come from outside sources.

## Fix

- magento-lts before `20.18.2`: move to `20.18.2`.
- magento-lts `21.0.0-beta1` through `21.0.0-beta2`: move to `21.0.0-beta3`.

## Timeline

- 2026-11-13T10:47:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128029

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors
- [fix] Patch: github.com https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de

## From the sources

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_