Cross-Site Scripting Vulnerability in Sylius eCommerce Platform

CVE-2024-34349

Summary

Sylius, an open-source eCommerce platform, has a vulnerability that allows for the execution of JavaScript code within the Admin panel prior to versions 1.12.16 and 1.13.1. This security flaw potentially enables attackers to perform cross-site scripting (XSS) attacks by injecting scripts into the Name fields of entities such as Taxons, Products, Product Options, or Product Variants. The malicious code could be executed through an autocomplete feature in the Admin Panel or within the category tree of taxons on product forms. Users are advised to upgrade to the latest fixed versions to safeguard their platforms against such attacks. For further details, visit the official security advisory here and the commit information here.

References