CVE-2026-42458

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-x8jv-q8j2-487c
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-x8jv-q8j2-487c

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Magento Long Term Support (LTS) es un proyecto no oficial, impulsado por la comunidad, que proporciona una alternativa a la plataforma de comercio electrónico Magento Community Edition con un alto nivel de compatibilidad con versiones anteriores. Antes de la versión 20.18.0, existe una vulnerabilidad de XSS reflejado bajo el panel de administración -> Sistema -> Importar/Exportar -> Perfiles de flujo de datos. Esta vulnerabilidad está corregida en la versión 20.18.0.

Information

Published : 2026-05-15 17:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-42458

Mitre link : CVE-2026-42458

CVE.ORG link : CVE-2026-42458

JSON object : View

Products Affected

No product.

CWE

CWE-87

Improper Neutralization of Alternate XSS Syntax

{"id": "CVE-2026-42458", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42458", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T17:58:08.186737Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenMage", "product": "magento-lts", "versions": [{"status": "affected", "version": "< 20.18.0"}]}]}], "published": "2026-05-15T17:16:46.900", "references": [{"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-x8jv-q8j2-487c", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-x8jv-q8j2-487c", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-87"}]}], "descriptions": [{"lang": "en", "value": "Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0."}, {"lang": "es", "value": "Magento Long Term Support (LTS) es un proyecto no oficial, impulsado por la comunidad, que proporciona una alternativa a la plataforma de comercio electr\u00f3nico Magento Community Edition con un alto nivel de compatibilidad con versiones anteriores. Antes de la versi\u00f3n 20.18.0, existe una vulnerabilidad de XSS reflejado bajo el panel de administraci\u00f3n -> Sistema -> Importar/Exportar -> Perfiles de flujo de datos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 20.18.0."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}