{"id":"CVE-2026-118560","aliases":["DRUPAL-CONTRIB-2026-265"],"title":"Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265","titleSource":"drupal","descriptionSource":"OSV","description":"This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.\n\nUnder certain rare circumstances, the module may expose a cross-site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service.","severity":"unknown","score":null,"published":"2026-10-28T16:57:01.000Z","modified":"2026-10-30T13:45:02.876Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/commerce_stripe","sources":[{"name":"OSV · DRUPAL-CONTRIB-2026-265","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-265"}],"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.2.3"}],"type":"ECOSYSTEM","database_specific":{"constraint":">=2.0.0 <2.2.3"}}],"versions":[],"fixed":["2.2.3"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2026-265"],"sources":[{"name":"CVE","id":"CVE-2026-118560","modified":"2026-10-30T03:09:01.410Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118560"},{"name":"OSV","id":"DRUPAL-CONTRIB-2026-265","modified":"2026-10-30T13:45:02.876062497Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-265"}],"assessments":[],"cve":{"records":[{"id":"CVE-2026-118560","source":"drupal","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T15:50:46.719Z","published":"2026-10-30T03:09:01.410Z","modified":"2026-10-30T03:09:01.410Z"}],"publishers":[{"name":"drupal","role":"CNA","organizationId":"2c85b837-eb8b-40ed-9d74-228c62987387","modified":"2026-10-30T03:09:01.410Z"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-265","tags":[],"source":"drupal"}],"weaknesses":[{"id":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")","source":"drupal"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"Drupal","name":"Commerce Stripe","platforms":[],"versions":[{"version":"2.0.0","status":"affected","lessThan":"2.2.3","versionType":"semver"}],"cpes":[],"source":"drupal","url":"https://www.cve.org/CVERecord?id=CVE-2026-118560"}],"remediation":[],"observedAt":"2026-10-30T14:44:32.741Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:00:36.834Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T06:05:32.390Z","attemptedAt":"2026-10-30T06:05:32.390Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T06:05:32.556Z","attemptedAt":"2026-10-30T06:05:32.556Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T06:05:32.322Z","attemptedAt":"2026-10-30T06:05:32.322Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T06:05:32.141Z","attemptedAt":"2026-10-30T06:05:32.141Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113507","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113507","modified":"Oct 30, 2026, 3:09:01 AM","checkedAt":"2026-10-30T06:05:32.322Z"},{"source":"NVD","id":"CVE-2026-118560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118560","modified":"2026-10-30T04:18:21.690","checkedAt":"2026-10-30T06:05:32.390Z"}],"aiSummary":{"text":"The Commerce Stripe module for Drupal has a cross-site scripting vulnerability under rare circumstances, affecting version 2.0.0. An attacker must have administrator permissions to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T14:46:08.590Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118560"},{"name":"OSV","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-265"}]}}