AIKIDO-2025-10691
shopware/storefront is vulnerable to Cross-site Scripting (XSS)
60
Medium Risk
This Affects:
shopware/storefrontTL;DR
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to insufficient input validation in the activeRouteParameters variable at the /page/cms/* and /widget/cms/* endpoints. An attacker can craft a malicious URL and trick a user into visiting it, enabling the execution of arbitrary JavaScript in the victim’s browser. This can result in the theft of session cookies and administrative tokens, as well as allow the attacker to perform unauthorized actions on behalf of the affected user.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
shopware/storefront is vulnerable to Cross-site Scripting (XSS) in versions 6.6.10.0 - 6.7.2.0.
How to fix this
Upgrade the shopware/storefront library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant