—

DRUPAL-CONTRIB-2026-179

Details

This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation.

The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist:https://packages.drupal.org/8/drupal/commerce_decoupled_checkout

Introduced in: 1.0.0Fixed in: 1.8.0

Upgrade drupal/commerce_decoupled_checkout to 1.8.0 or newer (ecosystem packagist:https://packages.drupal.org/8).

References

https://www.drupal.org/sa-contrib-2026-179[WEB]