DemoBook a demo

Vulnerability advisory

GHSA-5pxh-89cx-4668

Magento LTS vulnerable to stored XSS in theme config fields

Published Updated OSV record ↗

Also known as CVE-2025-27400

Severity
  • CVSS 3.xCVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Affected versions

openmage/magento-lts Packagist

All openmage/magento-lts advisories →
AffectedFixed in
All versions before 20.12.320.12.3Advisories →
Also listed as affected (85)

Description

As reported by Aakash Adhikari, Github: @justlife4x4, the Design > Themes > Skin (Images / CSS) config field allows a Stored XSS when it contains an end script tag.

Impact

A malicious user with access to this configuration field could use a Stored XSS to affect other authenticated admin users in the admin panel.

The attack requires an admin user with configuration access, so in practice, it is not very likely to be used for gaining elevated privileges, although it could theoretically be used to impersonate other users.

[image: image]

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.