Skip to content

Magento XML Injection vulnerability in the Widgets Module

Critical severity GitHub Reviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Nov 6, 2025

Package

composer magento/community-edition (Composer)

Affected versions

< 2.3.7-p1
= 2.3.7
>= 2.4.2-p1, < 2.4.2-p2
= 2.4.2

Patched versions

2.3.7-p1
2.4.2-p2
composer magento/project-community-edition (Composer)
<= 2.0.2
None

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

References

Published by the National Vulnerability Database Sep 1, 2021
Published to the GitHub Advisory Database May 24, 2022
Reviewed Nov 6, 2025
Last updated Nov 6, 2025

Severity

Critical

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(93rd percentile)

Weaknesses

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Learn more on MITRE.

CVE ID

CVE-2021-36033

GHSA ID

GHSA-p746-qw73-qmmx

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.