| Package | Affected versions | Patched versions |
|---|---|---|
| vendure | = 0.1.0≥ 0.1.2, ≤ 1.5.1 |
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the “Assets” tab. The uploaded file will affect administrators as well as regular users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free