CVE-2026-128029

Description

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.

References

• https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-28hq-mq6h-fh2x
• https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-dataflow-import-row-errors