CVE-2026-10769

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 3.3.0 through 3.3.6

Description Stored Cross-site Scripting (XSS) occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the order receipt email template. This issue specifically affects installations where the commerce checkout module is enabled and the customer comments checkout pane is explicitly used, as this pane is disabled by default.

Recommendations Update Drupal Commerce Core to a version later than 3.3.6. As a temporary mitigation, disable the customer comments checkout pane.