A cross-site scripting flaw exists in the Sylius checkout login form. When a login attempt fails, the AuthenticationFailureHandler returns a JSON response whose message field is inserted directly into the page with innerHTML. Any HTML or JavaScript in that message is executed by the browser, allowing an attacker to run malicious scripts in the victim's context.

Sylius eCommerce Framework by Sylius. Versions below 2.0.16, 2.1.12, or 2.2.3 are vulnerable. The issue was fixed in those releases and all later versions.

The CVSS score of 5.3 reflects a moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation at this time, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the flaw triggers when a failed login attempt produces a JSON response that includes a message field rendered with innerHTML. The description implies that an attacker can influence the content of that message, which will be executed by the browser when rendered in the victim’s session. The risk is therefore limited to contexts where the checkout login form is displayed and the message is rendered; it does not involve server‑side code execution or privilege escalation.