https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T21:30:53.905590+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-43846 CVE-2021-43846 — CSRF forgery protection bypass for Spree::OrdersController#populate 2026-10-12T21:30:53.907182+00:00

Affected: solidusio solidus

`solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.

 https://cve.radiocsirt.org/vuln/ghsa-h3fg-h5v3-vf8m GHSA-h3fg-h5v3-vf8m — CSRF forgery protection bypass in solidus_frontend 2026-10-12T21:30:53.907233+00:00

Affected: RubyGems: solidus_frontend

### Impact CSRF vulnerability that allows a malicious site to add an item to the user's cart without their knowledge.

All `solidus_frontend` versions are affected. If you're using your own storefront, please, follow along to make sure you're not affected.

To reproduce the issue:

- Pick the id for a variant with available stock. From the rails console:

```ruby Spree::Variant.in_stock.pluck(:id) ```

Say we pick variant id `2`.

- Launch your application, for instance, on `http://localhost:3000`:

```bash bin/rails server ```

- Open your browser dev tools.

- Click on whatever link in your store.

- Copy the value of the `Cookie` request header sent for the previous request from your browser dev tools.

- Execute the following, using your previously selected variant id and the value of the `Cookie` header (notice how it doesn't contain any authentication token):

```bash curl -X POST -d "variant_id=2&quantity=1" -H "Cookie: guest_token=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklrWlRVMWRQWnpKMVZVdFNXRzlPVW1aaWJHTjZZa0VpIiwiZXhwIjpudWxsLCJwdXIiOiJjb29raWUuZ3Vlc3RfdG9rZW4ifX0%3D--5006ba5d346f621c760a29b6a797bf351d17d1b8; _sandbox_session=vhutu5%2FL9NmWrUpGc3DxrFA%2FFsQD1dHn1cNsD7nvE84zcjWf17Af4%2F%2F2Vab3md71b6KTb9NP6WktdXktpwH4eU01jEGIBXG5%2BMzW5nL0nb4W269qk1io4LYljvoOg8%2BZVll7oJCVkJLKKh0sSoS0Kg8j%2FCHHs%2BsShohP%2BGnA%2Bfr9Ub8H6HofpSmloSpsfHHygmX0ho03fEgzHJ4DD5wJctaNKwg7NhVikHh5kgIPPHl84OGCgv3p2oe9jR19HTxOKq7BtyvDd7XZsecWhkcfS8BPnvDDUWZG6qpAEFI5kWo81KkpSJ%2Bp6Q1HOo8…