- Package
- drupal/commerce_stripe
- Fixed in
- 2.2.3
- Published
- Wed 28 Oct 2026, 16:57 Lisbon
In plain words
The module may allow cross-site scripting in rare circumstances. An attacker must have administrator permissions to configure payment gateways and use Stripe Connect, and an external service must also be compromised.
Am I affected?
Look for drupal/commerce_stripe and its version in composer.lock. The advisory lists 2.2.3 as fixed but gives no affected version range. Check whether your project uses Stripe Connect, and review who has administrator permissions to configure payment gateways. The described flaw also requires a compromised external service.
What to do
Check which version you have, then update to a fixed release for your branch (2.2.3):
composer show drupal/commerce_stripe | grep versions
composer update drupal/commerce_stripeIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by requiring an attacker to have administrator permissions to configure payment gateways and use Stripe Connect, in conjunction with the compromise of an external service.
The advisory's description
This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.
Under certain rare circumstances, the module may expose a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have administrator permissions to configure payment gateways and use the Stripe Connect in conjunction with the compromise of an external service.