CVE-2026-128053

MEDIUM 4.7

OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.

CWE	CWE-79
Vendor	openmage
Product	magento-lts
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for openmage magento-lts

Be the first to know when new medium vulnerabilities affecting openmage magento-lts are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

OpenMage / magento-lts

0 < 20.18.2

OpenMage / magento-lts

21.0.0-beta1 < 21.0.0-beta3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6pvw-8mv9-r8vr github.com: https://github.com/OpenMage/magento-lts/commit/0bcec215c25941f900d46657d63fd0862960edf6 vulncheck.com: https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-reflected-xss-via-error-pages-script-name

Credits

justlife4x4 🔍 0xElkot colinmollenhour