CVE-2026-91013

Executive Summary

CVE-2026-91013 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, carrying a CVSS base score of 9.3 (Critical). The flaw allows an attacker to inject malicious JavaScript into vulnerable form fields, which is then persisted server-side and executed in the browser of any user who subsequently views the affected page. Because the CVSS scope is marked as Changed (S:C), successful exploitation can compromise resources beyond the vulnerable component itself — including administrator sessions, customer accounts, and downstream administrative functionality.

Technical Analysis

This vulnerability is classified as CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting), specifically the stored (persistent) subtype. Unlike reflected XSS, where the malicious payload is echoed back within the same request/response cycle, stored XSS occurs when attacker-controlled input is written to a persistent data store (such as a database field, product attribute, customer profile field, or CMS content block) and later rendered into HTML without adequate output encoding or sanitization.

The attack surface for Adobe Commerce stored XSS is broad by design: the platform exposes numerous user-facing and administrative form fields across catalog management, customer account management, checkout, review systems, CMS pages/blocks, and order management. Any form field that accepts user input and is later rendered to another user's browser is a potential injection point. The NVD description confirms the mechanism: malicious scripts are injected "into vulnerable form fields" and "may be executed in a victim's browser when they browse to the page containing the vulnerable field."

Two properties of this CVE elevate its severity:

1. No privileges required (PR:N) and no authentication for the attack vector. The attack surface is reachable over the network (AV:N) with low complexity (AC:L). This means an unauthenticated actor may be able to inject the payload into a field that is publicly writable — for example, a guest-accessible review form, a newsletter signup field, or a contact form that is later rendered in an administrative inbox or report.

2. Scope Changed (S:C). The vulnerable component (the form field / rendering page) is not the only security authority impacted. Exploitation can affect resources outside the vulnerable component's security scope — in practice, this means a payload injected via a low-privilege or public interface can execute in a high-privilege administrative session when an admin views the poisoned record. This is the classic privilege-escalation-via-stored-XSS pattern and is the primary reason the impact subscore reaches High (C:H/I:H).

The Confidentiality (C:H) and Integrity (I:H) impacts reflect that a successfully executed payload runs with the full privileges of the victim's browser session: reading DOM content, harvesting session cookies or CSRF tokens, performing authenticated actions on behalf of the victim, and exfiltrating data. Availability (A:N) is rated None — the flaw does not degrade service availability.

The UI:R (User Interaction Required) metric reflects that exploitation requires a victim to browse to the poisoned page, but this is a low bar in a stored context — the victim simply navigates to an existing, otherwise-legitimate page (e.g., a product page or order view) that happens to contain the injected field.

No public proof-of-concept, exploit code, or Nuclei template is available as of this report. The CVE is not listed in CISA KEV. No EPSS score has been assigned by FIRST.org. No affected version range, OSV package data, or vendor patch has been published in tracked sources. All exploitation detail below is therefore described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the stored XSS vulnerability class and the CVSS characteristics (PR:N, UI:R, S:C). No specific function names, endpoints, parameters, or file paths are asserted because the NVD description does not provide them.

Step 1 — Reconnaissance / target identification. The attacker identifies an Adobe Commerce instance by fingerprinting platform-specific static asset paths, admin URLs, and JavaScript artifacts served by the storefront. Targets of interest are any forms whose input is later displayed to other users — particularly fields visible to administrative staff (order notes, customer records, support tickets, review moderation queues) or to other customers (product reviews, Q&A, profile fields).

Step 2 — Triggering the flaw class. The attacker submits crafted input containing script-capable markup into a form field that is persisted server-side without proper neutralization on output. Because PR:N is indicated, the entry point may not require authentication — publicly writable fields such as guest review submissions or public-facing forms are prime candidates for a "low-privilege write → high-privilege read" injection path.

Step 3 — Payload / execution (class level). Because this is stored XSS, the payload persists in the data store. When any user — ideally an administrator or privileged operator — navigates to the page that renders the poisoned field, the browser parses and executes the injected script in the origin/context of the Adobe Commerce application. Execution occurs automatically on page load; no further attacker action is required at trigger time.

Step 4 — Post-exploitation impact. The script executes with the victim's session privileges. Consistent with S:C scope change, likely objectives include: exfiltrating session tokens and CSRF tokens, performing authenticated state-changing requests on behalf of the victim (account modification, order manipulation, data export), harvesting credentials or PII rendered in the victim's context, or pivoting into administrative functionality. Because the compromise crosses security scopes, an unauthenticated or low-privilege injection can translate into control over administrative sessions — the primary driver of the 9.3 score.

Prerequisites and constraints. A victim must browse to the poisoned page (UI:R). The attacker does not need a valid account if a publicly writable field is the injection point, but must be able to persist input. No exploit code is publicly documented, so real-world tradecraft for this specific CVE is unobserved to date.

Impact Assessment

Business impact is potentially severe for any organization running an exposed Adobe Commerce storefront:

• Account and session takeover. Executed payloads run with the victim's privileges. Administrative session compromise can yield full storefront control — configuration changes, payment/order manipulation, customer data access, and injection of further persistent payloads.
• Customer data exposure (C:H). Stored XSS can exfiltrate PII, order history, and credentials rendered in victim sessions, carrying regulatory implications (GDPR, CCPA) for merchants.
• Integrity loss (I:H). Attackers can modify storefront content, orders, or account state via the victim's authenticated context.
• Scope change amplification (S:C). The most consequential property: a public or low-privilege injection point can compromise a high-privilege administrative session — an asymmetry that raises blast radius well beyond a single account.
• Availability: None (A:N). No direct denial of service is described.

The affected system class is Adobe Commerce (formerly Magento Commerce) deployments, including cloud and on-premise merchant storefronts. Exact vulnerable version ranges are not published in the available data, so all deployed instances in scope of the advisory should be treated as potentially affected until the vendor publishes version guidance. There is no evidence of active exploitation, KEV listing, or EPSS scoring; risk is currently assessed as latent but critical-severity rather than actively exploited.

Detection Guidance

Sigma Rule

title: Stored XSS Payload Submission in Adobe Commerce Form Fields
id: 6f3a1c42-9b77-4d21-a8e5-c0d2e4f7b913
status: experimental
description: Detects HTTP POST requests containing script-capable payloads to Adobe Commerce form endpoints, indicative of stored XSS injection attempts (CVE-2026-91013).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91013
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'POST'
  selection_payload:
    - 'cs-uri-query|contains':
        - '<script'
        - 'javascript:'
        - 'onerror='
        - 'onload='
        - '"><script'
        - '%3Cscript'
  condition: selection_method and selection_payload
falsepositives:
  - Legitimate content authors pasting escaped code samples
  - Security scanners and penetration tests
level: high
tags:
  - attack.t1189
  - attack.t1059.007
  - cve.2026.91013

YARA Rule

rule CVE_2026_91013_Stored_XSS_Adobe_Commerce
{
    meta:
        description = "Detects stored XSS payload markers associated with CVE-2026-91013 in Adobe Commerce form submissions and stored content"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91013"
        severity = "critical"

    strings:
        $s1 = "<script" nocase
        $s2 = "</script>" nocase
        $s3 = "javascript:" nocase
        $s4 = "onerror=" nocase
        $s5 = "onload=" nocase
        $s6 = "onmouseover=" nocase
        $s7 = "document.cookie" nocase
        $s8 = "document.location" nocase
        $s9 = "eval(" nocase

    condition:
        uint16(0) == 0x3C21 or
        (2 of ($s1, $s2, $s3, $s4, $s5, $s6) and 1 of ($s7, $s8, $s9))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91013 Adobe Commerce Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<script"; nocase; http.request_body; content:"document.cookie"; nocase; reference:cve,2026-91013; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91013; classtype:web-application-attack; sid:202691013; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method == "POST" and
    http.request.body.content : ("<script" or "javascript:" or "onerror=") ]
  [ network where network.protocol == "http" and http.request.method == "POST" and
    http.request.body.content : ("document.cookie" or "eval(" or "onload=") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval reqbody=coalesce(form_data, post_body, uri_query)
| where match(reqbody, "(?i)(<script|javascript:|onerror=|onload=|document\.cookie|eval\()")
| stats count values(uri) as endpoints values(src_ip) as source_ips by clientip, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve_2026_91013,">
  <rule id="100913" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST</match>
    <regex type="pcre2">(?i)(%3Cscript|<script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-91013: Possible Adobe Commerce stored XSS injection attempt in form submission</description>
    <mitre>
      <id>T1189</id>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_91013,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround has been identified from any tracked source. The following guidance is defensive-in-depth based on the stored XSS vulnerability class.

1) Immediate mitigations (while unpatched):

• Deploy a Web Application Firewall (WAF) with virtual patching rules targeting script-capable payloads in form POST bodies, and enable strict output encoding/HTML sanitization at the edge if supported.
• Restrict write access to publicly exposed form fields where possible; require authentication, CAPTCHA, and moderation for reviews, comments, and other user-generated content.
• Enforce Content Security Policy (CSP) headers that disallow inline script execution (script-src without unsafe-inline, nonce- or hash-based allowlisting) to reduce payload execution even if injection succeeds.
• Set session cookies with HttpOnly and Secure flags to limit token theft via injected JavaScript.
• Apply aggressive input validation and server-side output encoding at all rendering points for user-supplied data.

2) Patch / upgrade steps:

• Monitor Adobe's official security bulletins (helpx.adobe.com/security.html) and the Adobe Commerce Security Center for an APSB advisory addressing this CVE.
• Once a fixed version is published, upgrade all affected Adobe Commerce instances promptly and test form-field rendering post-upgrade.
• Because no version range has been published, inventory all Adobe Commerce deployments and treat them as in-scope until Adobe clarifies affected versions.

3) Long-term hardening:

• Adopt a context-aware output-encoding framework discipline for every user-controlled value rendered into HTML, attributes, JavaScript, and CSS contexts.
• Implement mandatory CSP with reporting to catch attempted inline execution.
• Continuously monitor stored content (product fields, reviews, CMS blocks, customer records) for injected markup via scheduled content scanning.
• Enforce least privilege on administrative accounts and segment admin access to reduce the blast radius of scope-changed session compromise.

References

1. NVD — CVE-2026-91013: https://nvd.nist.gov/vuln/detail/CVE-2026-91013
2. MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
3. OWASP — Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
4. Adobe Security Bulletins and Advisories (vendor advisory pending): https://helpx.adobe.com/security.html
5. MITRE ATT&CK — T1189 Drive-by Compromise / T1059.007 JavaScript: https://attack.mitre.org/techniques/T1189/

Threat actor and exploit-in-the-wild status: No known threat actor campaigns, no public PoC/exploit code, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-91013 as of this report. No EPSS score has been assigned.