MAGENTO-LTS · CVE-2026-128041 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts serves its RSS feeds as text/html and does not escape review data in them. An unauthenticated guest can post a product review containing script, which runs in the browser of an administrator who opens the pending-reviews feed, enabling admin account takeover.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts versions before 20.18.2 or the 21.0.0-beta1 and 21.0.0-beta2 betas are exposed. The attack needs a guest to be able to submit product reviews and an administrator to open the pending-reviews feed, so stores with reviews disabled or no admin feed use are lower risk. Sites on other Magento distributions are not covered by this advisory.
Not affected if magento-lts-patched, other-magento-distribution, reviews-disabled
Who cares magento, magento-lts, openmage, php, self-hosted
20.18.2 on the 20.x line, or below 21.0.0-beta3 on the 21.x beta line, are in the affected range.20.18.2 or later on the 20.x line.21.0.0-beta3 or later.OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.