AIKIDO-2026-11133

TL;DR

The default spree_storefront theme renders product.storefront_description through the raw helper in product description and details templates. An attacker who can edit product HTML through the admin editor source view or the API can inject <script> tags or event handlers into descriptions. The injected markup executes in the browser of every visitor who views the affected product page. The fix replaces raw with sanitize, stripping dangerous tags while preserving safe formatting HTML.