CVE-2026-128053: OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPTNAME from the request path, executing script in the storefront origin within victims' browsers.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Exposure depends on the server deriving SCRIPT_NAME from the request path. The vulnerable behavior is in error pages that render SCRIPT_NAME-derived URLs without escaping, so an attacker must also be able to trigger an uncaught exception.
Does exploitation require authentication or any special privileges?
No authentication or privileges are required. An attacker can craft a link for a victim to open, and successful exploitation executes script in the storefront origin in that victim's browser.
Which releases are affected?
Affected releases are OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. Updating to 20.18.2 or 21.0.0-beta3 addresses the affected version ranges.