CVE-2026-29176
Craft Commerce has stored XSS in Inventory Location Name
Impact
## Summary A stored XSS vulnerability exists in the Commerce Settings - Inventory Locations page. The **Name** field is rendered without proper HTML escaping, allowing an attacker to execute arbitrary JavaScript. This XSS triggers when an administrator (or user with product editing permissions) creates or edits a variant product. ## Proof of Concept ### Permissions Required - General - Access the control panel - Access Craft Commerce - Craft Commerce - Manage inventory locations ### Steps to Reproduce 1. Log in to the control panel 2. Navigate to **Commerce → Inventory Locations** 3. Create or edit a location 4. Set **Name** to the following payload: ```html <img src=x onerror="alert('XSS')"> ``` 5. Save the location 6. Navigate to **Commerce → Products** and click "New Product" and click "New product variant" 7. The Inventory Location table loads, rendering the **Inventory Location Name** 8. XSS executes ## Impact - Potential Session Hijacking - Potential Database Exfiltration - Potential Account Takeover by forcing a password change on the victim’s account. - Potential Privilege escalation, or creating new admin users. ## Mitigation Sanitize the inventory location name field when rendering in the "Track Inventory" table.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/commerce | >= 5.0.0, <= 5.5.2 | 5.5.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Commerce | from 5.0.0 before 5.5.3 |