Squinard1478

**Name of the Vulnerable Software and Affected Versions** Vendure versions prior to 3.6.5 **Description** Stored cross-site scripting (XSS) exists in the admin dashboard due to unsafe HTML stripping in the `RichTextDescriptionCell` component within `packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx`. The component attempts to remove markup by assigning an administrator-controlled `description` to a live element's `innerHTML` and then reading the `textContent`. This process allows active resource markup, such as `<img src=x onerror=...>`, to execute event handlers during the assignment before the text is read. A lower-privilege administrator can store malicious markup in the `description` fields of the Products, Collections, Promotions, Payment Methods, or Shipping Methods lists. The script executes when another administrator views the affected row, potentially compromising their session and enabling cross-privilege or cross-channel administrative actions. **Recommendations** Update to version 3.6.5. As a temporary workaround, restrict write permissions for the `description` field in the Products, Collections, Promotions, Payment Methods, and Shipping Methods lists to trusted administrators only.

**Name of the Vulnerable Software and Affected Versions** Vendure versions prior to 3.7.0 **Description** An account takeover issue exists in the headless commerce platform where the `ExternalAuthenticationService.createCustomerAndUser()` function links a new external authentication method to an existing user account based solely on an `emailAddress` match, without verifying if the email ownership was confirmed by the provider. In environments using a custom `AuthenticationStrategy` that forwards unverified emails, an attacker can use a victim's email address through an external provider to bind their own identity to the victim's account. This allows the attacker to access personal information, addresses, and orders, as well as modify account details or place orders on behalf of the victim. This issue specifically affects deployments using external or social authentication strategies that do not strictly require provider-verified email ownership. **Recommendations** Upgrade to version 3.7.0. As a temporary mitigation, restrict the use of custom `AuthenticationStrategy` implementations that do not guarantee the `verified` status of the forwarded `emailAddress`.