SA-CONTRIB-2026-265: Critical severity composer/drupal/commerce_stripe vulnerability

Q: Who is realistically able to exploit this issue?

An attacker needs administrator permissions to configure payment gateways. Exploitation also requires using Stripe Connect together with compromise of an external service, so it is not described as exploitable by an unauthenticated or ordinary user.

Q: Is a default installation affected?

The issue is described as occurring only under rare circumstances involving Stripe Connect and an external service compromise. The available information does not establish that a default configuration is affected.

Published Oct 28, 2026

Updated

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. Under certain rare circumstances, the module may expose a cross-site scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service.

Credit

Brian Willows (hsjbrianwillows)

Affected Software

1 affected componentFixes available

composer/drupal/commerce_stripe<2.2.3

2.2.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/commerce_stripe to a version that resolves this vulnerability.
Fixed in 2.2.3

Event History

Oct 28, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically able to exploit this issue?

An attacker needs administrator permissions to configure payment gateways. Exploitation also requires using Stripe Connect together with compromise of an external service, so it is not described as exploitable by an unauthenticated or ordinary user.

Is a default installation affected?

The issue is described as occurring only under rare circumstances involving Stripe Connect and an external service compromise. The available information does not establish that a default configuration is affected.

SA-CONTRIB-2026-265: Critical severity composer/drupal/commerce_stripe vulnerability

Credit

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically able to exploit this issue?

Is a default installation affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically able to exploit this issue?

Is a default installation affected?