{"action":"Upgrade @vendure/dashboard to 3.6.5 or later.","affected":[{"fixed":"3.6.5","introduced":"0"}],"component":"@vendure/dashboard","cve_ids":["CVE-2026-63459"],"ecosystem":"npm","epss":0.00416,"exploited":false,"fixed_versions":["3.6.5"],"ghsa_id":"GHSA-xhq9-whgq-49j5","id":"tcs_01M5KGJ61QJ2YY8FC6DSPQCES3","modified_at":"2026-09-17T15:00:06.524070422Z","published_at":"2026-09-17T14:49:34Z","references":["https://osv.dev/vulnerability/GHSA-xhq9-whgq-49j5","https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5","https://github.com/vendurehq/vendure/commit/d7aa42a3f0cb524297a1a2fdf700e4aba9aca684","https://github.com/vendurehq/vendure","https://github.com/vendurehq/vendure/releases/tag/v3.6.5"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-xhq9-whgq-49j5","url":"https://osv.dev/vulnerability/GHSA-xhq9-whgq-49j5"}],"summary":"Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions"}