CVE-2026-128053 · Package
NO FIX YET · SEE WHAT TO DO
OpenMage magento-lts prints URLs derived from SCRIPT_NAME on its error pages without escaping them, so a crafted link can make an uncaught exception render attacker script. The script runs in the storefront origin inside the victim's browser, unauthenticated.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through before 21.0.0-beta3, whose error pages render SCRIPT_NAME-derived URLs. Exposure depends on the server deriving SCRIPT_NAME from the request path so that crafted links reach the error handler; teams on patched releases or not using that server configuration can skip it.
Not affected if default-config, patched-version
Who cares magento-lts, openmage, php, self-hosted
20.18.2 on the 20.x line and 21.0.0-beta1 through before 21.0.0-beta3 on the 21.x beta line.20.18.2 or later on the 20.x line21.0.0-beta3 or later on the 21.x beta lineOpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.