CVE-2026-6745: Bagisto Cross-site Scripting Vulnerability
Summary
CVE-2026-6745: Bagisto affected by Cross-site Scripting. Affects bagisto/bagisto versions < 2.3.15. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bagisto is an open-source eCommerce framework built on Laravel, designed to provide a robust platform for online stores. It offers features such as product management, order processing, and customer engagement tools. However, versions up to 2.3.15 are vulnerable to a cross-site scripting (XSS) issue, which can compromise the security of applications built on this framework.
Vulnerability Detail
A vulnerability exists in Bagisto versions up to 2.3.15, specifically within the Custom Scripts Handler component. This vulnerability allows for cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts into web pages viewed by other users. The exploitation of this vulnerability can lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking. The issue has been publicly disclosed, and remote exploitation is possible, making it critical for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can sanitize any user inputs and outputs to prevent the execution of malicious scripts. Implementing Content Security Policy (CSP) headers can also help mitigate the risk of XSS attacks.
Conclusion
The vulnerability identified as CVE-2026-6745 in Bagisto poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly encouraged to update to the latest version to protect their applications and users from exploitation. Additionally, temporary workarounds can help mitigate risks until a full update can be performed.
See every vulnerability recorded for bagisto/bagisto →
FAQ
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session integrity.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and session hijacking, posing significant risks to user security and application integrity.
Yes, a patched version of Bagisto is available. Users should update to the latest version to mitigate the risk associated with this vulnerability.
If immediate updates are not possible, implement input sanitization and consider using Content Security Policy (CSP) headers to reduce the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for bagisto/bagisto.
