CVE-2026-128029: OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attributeset columns of an import file to run script in the session of the administrator who imports it.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
OpenMage magento-lts versions before 20.18.2 are affected, as are 21.0.0-beta releases before 21.0.0-beta3.
What must an attacker do to exploit this issue?
An attacker must provide an import file containing markup in the store, type, or attribute_set columns. Exploitation occurs when an administrator imports that file and the resulting catalog product row errors are displayed on the Dataflow profile run page.
Does exploitation require administrator interaction?
Yes. The attacker does not need authentication, but an administrator must import the crafted file and view the affected error output for script to run in that administrator's session.
What is the immediate mitigation if an update cannot be applied?
Do not import untrusted catalog product import files, particularly files with untrusted values in the store, type, or attribute_set columns. Restrict who can supply files for Dataflow imports.