drupal/commerce_stripe · Commerce stripe: This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store
Affects drupal/commerce_stripeSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 2.2.3
Data as of 28 Oct 2026, 20:43 UTC
What to do
Upgrade drupal/commerce_stripe to 2.2.3.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagist https //packages.drupal.org/8drupal/commerce_stripe | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade the Drupal Commerce Stripe module to version 2.2.3 or later, where the vulnerability is fixed. Since the vulnerability requires administrator permissions and external service compromise, ensuring strict access controls and securing external integrations also helps mitigate risk.
Description
The Drupal Commerce Stripe module versions 2.0.0 up to but not including 2.2.3 contain a cross-site scripting (XSS) vulnerability that may be exposed under rare circumstances. Exploitation requires the attacker to have administrator permissions to configure payment gateways and also depends on the compromise of an external service. The vulnerability has been fixed in version 2.2.3.