{"id":"CVE-2026-128053","kind":"vulnerability","aliases":["CVE-2026-128053"],"related":[],"title":"OpenMage magento-lts: error pages let crafted links run script in browsers","description":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.","summary":"OpenMage magento-lts prints URLs derived from SCRIPT_NAME on its error pages without escaping them, so a crafted link can make an uncaught exception render attacker script. The script runs in the storefront origin inside the victim's browser, unauthenticated.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magento-lts","openmage","package","php","self-hosted"],"not_affected_if":["default-config","patched-version"],"how_to_check":"- Check the installed magento-lts version in composer.json or the OpenMage release in use; affected before `20.18.2` on the 20.x line and `21.0.0-beta1` through before `21.0.0-beta3` on the 21.x beta line.\n- Check whether the server derives SCRIPT_NAME from the request path so that error pages are reachable via crafted URLs.","fix":"- magento-lts: upgrade to `20.18.2` or later on the 20.x line\n- magento-lts: upgrade to `21.0.0-beta3` or later on the 21.x beta line","status":"open","published_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:58:44+00:00","updated_at":"2026-11-13T10:58:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:58:44Z","model":"claude-haiku-5-5","output":{"fix":"- magento-lts: upgrade to `20.18.2` or later on the 20.x line\n- magento-lts: upgrade to `21.0.0-beta3` or later on the 21.x beta line","reach":"internet","title":"OpenMage magento-lts: error pages let crafted links run script in browsers","impact":"medium","summary":"OpenMage magento-lts prints URLs derived from SCRIPT_NAME on its error pages without escaping them, so a crafted link can make an uncaught exception render attacker script. The script runs in the storefront origin inside the victim's browser, unauthenticated.","audience":"businesses","category":"package","nicknames":[],"who_cares":["magento-lts","openmage","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker script runs in storefront visitors' browsers.","analyst_note":"Product ranges were not supplied; confirm the affected range against the Patch and vendor advisory links.","how_to_check":"- Check the installed magento-lts version in composer.json or the OpenMage release in use; affected before `20.18.2` on the 20.x line and `21.0.0-beta1` through before `21.0.0-beta3` on the 21.x beta line.\n- Check whether the server derives SCRIPT_NAME from the request path so that error pages are reachable via crafted URLs.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","default-config"],"who_is_affected":"Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through before 21.0.0-beta3, whose error pages render SCRIPT_NAME-derived URLs. Exposure depends on the server deriving SCRIPT_NAME from the request path so that crafted links reach the error handler; teams on patched releases or not using that server configuration can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000812,"input_tokens":4687,"output_tokens":686,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128053':16A,19A '-2026':15A,18A '20.18.2':76C '21.0.0':78C,81C 'attack':56B,108C 'beta1':79C 'beta3':82C 'browser':13A,69B,133C 'built':102C 'contain':83C 'craft':8A,48B,110C 'cross':87C 'cross-sit':86C 'cve':14A,17A 'deriv':35B,100C,118C 'error':5A,41B,93C 'errors/processor.php':104C 'escap':44B,106C 'except':54B,115C 'execut':125C 'host':28B 'insid':65B 'let':7A 'link':9A,49B,111C 'lts':4A,22B,32B,74C 'magento':3A,21B,31B,73C 'magento-lt':2A,20B,30B,72C 'make':51B 'name':38B,99C,120C 'name-deriv':98C 'openmag':1A,23B,29B,71C 'origin':64B,130C 'packag':24B 'page':6A,42B,94C 'path':124C 'php':25B 'print':33B,96C 'reflect':85C 'render':55B 'request':123C 'run':10A,60B 'script':11A,37B,57B,59B,89C,97C,119C,126C 'self':27B 'self-host':26B 'server':117C 'site':88C 'storefront':63B,129C 'trigger':113C 'unauthent':70B,107C 'uncaught':53B,114C 'url':34B,101C 'victim':67B,132C 'vulner':90C 'within':131C 'without':43B,105C","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenMage magento-lts before 20.18.2, or 21.0.0-beta1 through before 21.0.0-beta3, whose error pages render SCRIPT_NAME-derived URLs. Exposure depends on the server deriving SCRIPT_NAME from the request path so that crafted links reach the error handler; teams on patched releases or not using that server configuration can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["magentolts","medium","openmage","package","php","selfhosted"],"campaign_type":null,"search_a":"'-128053':16A,19A '-2026':15A,18A 'browser':13A 'craft':8A 'cve':14A,17A 'error':5A 'let':7A 'link':9A 'lts':4A 'magento':3A 'magento-lt':2A 'openmag':1A 'page':6A 'run':10A 'script':11A","search_b":"'attack':56B 'browser':69B 'craft':48B 'deriv':35B 'error':41B 'escap':44B 'except':54B 'host':28B 'insid':65B 'link':49B 'lts':22B,32B 'magento':21B,31B 'magento-lt':20B,30B 'make':51B 'name':38B 'openmag':23B,29B 'origin':64B 'packag':24B 'page':42B 'php':25B 'print':33B 'render':55B 'run':60B 'script':37B,57B,59B 'self':27B 'self-host':26B 'storefront':63B 'unauthent':70B 'uncaught':53B 'url':34B 'victim':67B 'without':43B","search_c":"'20.18.2':76C '21.0.0':78C,81C 'attack':108C 'beta1':79C 'beta3':82C 'browser':133C 'built':102C 'contain':83C 'craft':110C 'cross':87C 'cross-sit':86C 'deriv':100C,118C 'error':93C 'errors/processor.php':104C 'escap':106C 'except':115C 'execut':125C 'link':111C 'lts':74C 'magento':73C 'magento-lt':72C 'name':99C,120C 'name-deriv':98C 'openmag':71C 'origin':130C 'page':94C 'path':124C 'print':96C 'reflect':85C 'request':123C 'script':89C,97C,119C,126C 'server':117C 'site':88C 'storefront':129C 'trigger':113C 'unauthent':107C 'uncaught':114C 'url':101C 'victim':132C 'vulner':90C 'within':131C 'without':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T19:59:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128053","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128053","severity":null,"published_at":"2026-11-13T10:18:11+00:00","modified_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145421,"url":"https://github.com/OpenMage/magento-lts/commit/0bcec215c25941f900d46657d63fd0862960edf6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145422,"url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6pvw-8mv9-r8vr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T19:59:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145423,"url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-reflected-xss-via-error-pages-script-name","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}