CVE-2026-48358
Critical · 9.1CVSS
9.1
EPSS
1.2%
Published
Jul 14, 2026
CISA due date
—
The record
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
- CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-116
- CVE-2026-104368 The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege… CWE-116
- CVE-2026-118256 Vue I18n is the internationalization plugin for Vue.js. CWE-116
- CVE-2026-118257 Vue I18n is the internationalization plugin for Vue.js. CWE-116
- CVE-2026-110910 ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array… CWE-116
- CVE-2026-116582 Seroval facilitates JavaScript value stringification, including complex structures beyond… CWE-116
- CVE-2026-55442 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-116