Vendure versions prior to 3.6.5 contain a stored XSS vulnerability (CWE-79) in the RichTextDescriptionCell component used in the dashboard. The issue occurs because the component assigns administrator-controlled descriptions to a live element's innerHTML and then reads textContent to strip markup. However, active resource markup can execute event handlers during the innerHTML assignment before textContent is read. This allows a lower-privilege administrator to store malicious markup in descriptions rendered in various administrative lists. When another administrator views these lists, the malicious script executes, potentially compromising the session and enabling cross-privilege or cross-channel administrative actions. The vulnerability is addressed by the fix in version 3.6.5.

An attacker with lower-privilege administrator access can inject stored malicious scripts into descriptions that execute in the context of a higher-privilege administrator's session upon viewing. This can lead to session compromise and unauthorized administrative actions across privilege boundaries or administrative channels. The vulnerability has a CVSS score of 8.7 (high severity), indicating a significant risk to confidentiality and integrity without impacting availability.

Upgrade Vendure to version 3.6.5 or later, where this vulnerability is fixed. No other mitigation is indicated or required according to the available data.