Critical XSS vulnerability discovered in Bagisto 2.2.0

While running a routine sanity check on the latest Bagisto build recently, I uncovered a severe client side template injection flaw. This vulnerability essentially acts as a critical issue, allowing anyone to drop arbitrary JavaScript straight into the admin panel. Because Bagisto powers thousands of free storefronts, I realized immediately that the risk was far from theoretical. A single malicious payload could compromise countless merchant dashboards.

What I found was that Vue template delimiters are rendered verbatim inside the order details view. When a user submits data from checkout fields like company name, first name, state, or city, the system saves it without any escaping. When an administrator later opens that specific order, Vue evaluates the payload. It runs the attacker injected script with high privileges. The problem I was trying to solve was preventing these raw strings from being stored and later rendered in the admin UI without proper sanitization. The expected behavior is that all user input should be treated as plain text, meaning Vue delimiters are escaped or stripped so the browser displays them literally.

Here is exactly how I reproduced the issue to understand its scope:

1. Start the checkout process
   Add a product to the cart and proceed to the checkout screen.
2. Inject the payload
   In any of the free text fields like company name, first name, last name, state, or city, paste a payload like {{function(){this.alert(document.cookie)}()}} to test the vulnerability.
3. Complete the purchase
   Finish the transaction so the payload is saved to the database.
4. Access the admin dashboard
   Log into the Bagisto backend as an administrator.
5. View the compromised order
   Navigate to Sales then Orders then View for the newly created order.
6. Trigger the script
   The injected script fires immediately, revealing the admin cookie or executing whatever JavaScript was supplied.

The impact of this flaw is massive. Here are the potential consequences I considered:

1. Session hijacking
   An attacker can steal administrator cookies and take full control of the backend.
2. Phishing redirection
   Malicious scripts can send administrators to fake login pages to harvest their credentials.
3. Arbitrary JavaScript execution
   This opens the door to keylogging, data exfiltration, or even ransomware attacks.
4. Brand damage
   Compromised merchant sites lose trust and may face severe regulatory fallout.

To protect our merchants, I am pushing a patch out as soon as possible. In the meantime, I formulated some immediate mitigation recommendations:

1. Sanitize input fields
   Clean every input field on the server before persisting it to the database.
2. Escape Vue delimiters
   When rendering user generated content in the admin UI, explicitly escape the curly braces.
3. Deploy a strict content security policy
   Block inline scripts and limit approved script sources to prevent execution.
4. Upgrade immediately
   Move to the patched Bagisto release as soon as it becomes available.
5. Schedule regular security audits
   Regularly check third party packages and any template rendering pipelines for similar flaws.

I strongly urge all merchants to take temporary action while waiting for the official fix:

1. Scan recent orders
   Check the database manually for any stray curly brace strings and clean them up.
2. Limit administrator access
   Restrict backend logins to trusted IP ranges until the patch lands.
3. Watch system logs
   Keep an eye out for unexpected JavaScript errors or CSP violations that could indicate an attempted injection.

This client side template injection bug is a high risk issue for every Bagisto powered store. The sooner we lock down this vector, the better we protect our merchants and their customers.