View online: https://www.drupal.org/sa-contrib-2026-041 Project: Commerce Core [1] Date: 2026-June-03 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Affected versions: >= 3.3.0 < 3.3.6 CVE IDs: CVE-2026-10769 Description: The module doesn't sufficiently sanitize customer comments in the order receipt email template; this could be exploited to achieve Cross-site Scripting (XSS). This vulnerability is mitigated by the fact that it only affects installations with Checkout (commerce_checkout) enabled, and the "Comments" checkout pane (id: customer_comments) is explicitly used, which is disabled by default. Solution: Install the latest version: * If you use Commerce Core 3.3.x, upgrade to Commerce Core 3.3.6 [3] Reported By: * Brian Willows (hsjbrianwillows) [4] Fixed By: * Jonathan Sacksick (jsacksick) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Lee Rowlands (larowlan) [7] of the Drupal Security Team * Dave Long (longwave) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185078-commerce-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/3.3.6 [4] https://www.drupal.org/u/hsjbrianwillows [5] https://www.drupal.org/u/jsacksick [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/longwave [9] https://www.drupal.org/u/poker10 [10] https://git.drupalcode.org/security/185078-commerce-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....