CVE-2026-22849
NoneCVSS
—
EPSS
0.2%
Published
Jan 21, 2026
CISA due date
—
The record
Saleor lacks proper HTML sanitization in rich text fields
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-45118 MyBB is free and open source forum software. CWE-83
- CVE-2026-15920 An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. CWE-83
- CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. CWE-83
- CVE-2026-49276 Kirby is an open-source content management system. CWE-83
- CVE-2026-48591 Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave… CWE-83
- GHSA-6xcg-6q43-rj2v Duplicate Advisory: Exported session HTML could keep unsafe markdown links CWE-83
- CVE-2026-53841 OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported… CWE-83
- GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL CWE-83