CVE-2026-22849highCWE-83

CVE-2026-22849: high-severity vulnerability in saleor

Saleor lacks proper HTML sanitization in rich text fields

Published · Updated

Follow this CVE+ Monitor saleor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.2%
Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
saleor · saleor
Related CVEs — saleor

In the same product, most dangerous first.

CVE-2023-26051MEDIUMSaleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptionsEPSS 0.8%CVE-2022-39275MEDIUMImproper object type validation in saleorEPSS 0.8%CVE-2023-26052LOWSaleor is vulnerable to unauthenticated information disclosure via Python exceptionsEPSS 0.8%CVE-2026-44472HIGHSaleor: Account pre-hijacking vulnerability due to unverified anonymous order mergeEPSS 0.6%CVE-2024-29888MEDIUMSaleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery methodEPSS 0.5%CVE-2026-33756HIGHSaleor Affected by Denial of Service via Unbounded GraphQL Query BatchingEPSS 0.5%