CVE-2026-10769: Drupal Commerce XSS Vulnerability in Customer Comments
Summary
CVE-2026-10769: The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS). Affects drupal/commerce versions >= 3.3.0, < 3.3.6. Fixed in 3.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Commerce is a popular e-commerce framework for Drupal that allows users to create and manage online stores. It provides features such as product management, order processing, and customer interactions. The framework is widely used due to its flexibility and integration with the Drupal content management system. However, it is susceptible to vulnerabilities, including the one identified as CVE-2026-10769, which affects the handling of customer comments in order receipt emails.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of customer comments included in the order receipt email template. This oversight can be exploited to execute Cross-site Scripting (XSS) attacks, where malicious scripts are injected into web pages viewed by other users. The impact of such an attack could lead to unauthorized actions being performed on behalf of users, data theft, or defacement of the website. The vulnerability specifically affects installations with the Checkout module enabled and the 'Comments' checkout pane explicitly used, which is disabled by default.
How To Fix
Minimum fixed version
3.3.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if you are unable to update the package immediately, consider disabling the 'Comments' checkout pane in your checkout process to mitigate the risk of XSS attacks until the update can be applied.
Conclusion
In summary, CVE-2026-10769 is a critical XSS vulnerability in the Drupal Commerce module that can be exploited through customer comments in order receipt emails. It is essential for users to update to the patched version to safeguard their applications against potential attacks.
See every vulnerability recorded for drupal/commerce →
FAQ
CVE-2026-10769 is a vulnerability in the Drupal Commerce module that allows for Cross-site Scripting (XSS) due to insufficient sanitization of customer comments in order receipt emails.
Only installations of Drupal Commerce with the Checkout module enabled and the 'Comments' checkout pane explicitly used are affected. This pane is disabled by default.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized actions, data theft, or defacement of the website through XSS attacks.
The best way to protect your site is to update the Drupal Commerce package to version 3.3.6 or later. Additionally, consider disabling the 'Comments' checkout pane until the update is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/commerce.
