CVE-2026-63459: Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

The dashboard’s RichTextDescriptionCell “strips HTML” from an entity’s description by assigning it to a live element’s innerHTML and reading back textContent. This pattern still executes active markup: a description containing <img src=x onerror=…> runs script when the element is parsed (image resource loads even on a detached node in Chromium/Firefox, firing onerror). Because description is an admin-settable field shown in multiple list views, a lower-privilege administrator can store a payload that executes in a higher-privilege administrator’s browser when they open the corresponding list — stored XSS leading to admin-session compromise.