AIKIDO-2026-485491

TL;DR

Spree::OrdersHelper#truncated_product_description passes Spree::Product#description through raw before truncating it, so HTML stored in a product description, such as an onerror image tag or a script tag, reaches the checkout confirmation step and the order page unescaped. truncate_html only shortens the text and passes the markup through unchanged, so the markup executes in the browser of any customer who views an order containing that product, including guests following a tokenized order link. Planting the payload needs product management or superuser access in the back office, but the script then runs in the viewing customer's session and can issue same origin requests such as changing the account email. The fix sanitizes the description with the Rails allowlist sanitizer before truncation, unless a store has opted into Spree::Config.show_raw_product_description.