A stored cross-site scripting vulnerability in Vendure versions prior to 3.6.5 allows authenticated attackers to compromise administrative sessions and perform unauthorized actions.

This is a stored cross-site scripting (CWE-79) vulnerability occurring in the RichTextDescriptionCell component, where improper sanitization of markup allows an authenticated administrator to inject malicious scripts that execute when viewed by other administrators.

Successful exploitation permits a lower-privileged administrator to compromise the session of a higher-privileged user. This could lead to unauthorized cross-privilege or cross-channel administrative actions, potentially resulting in full platform compromise or unauthorized modification of commerce data. With a CVSS score of 8.7, this vulnerability represents a high-risk threat to the integrity and confidentiality of administrative operations.

Immediate Action: Update the Vendure dashboard component to version 3.6.5 or later to resolve the script injection flaw.

Proactive Monitoring: Monitor administrative audit logs for unusual activity or unexpected changes to product, collection, or promotion descriptions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect administrative input and block malicious script payloads.

Public Exploit Available: Unknown

Given the potential for privilege escalation and unauthorized administrative access, organizations utilizing Vendure should prioritize this update. Administrators must ensure that the dashboard component is patched to version 3.6.5 immediately to prevent potential session compromise by malicious insiders or compromised administrative accounts.