Security Changelog - Hyvä Themes
This page documents security-relevant vulnerability fixes for Hyvä Themes (Default Theme and Theme Module).
Default Theme 1.5.3, 1.4.11, 1.3.23 - 2026-10-12
Cross-Site Scripting in the MSRP Price and Popup Templates
Both MSRP templates escaped values for HTML while rendering them into JavaScript. In the price template this allowed a crafted product name to break out of the string and run script on the storefront for shoppers viewing the product, because the browser decodes the HTML entities in the x-data attribute before Alpine evaluates it. In the popup template the HTML escaping of the MSRP explanation messages prevented a break-out, but a crafted message could still break the popup script.
Both templates now escape these values for JavaScript. In 1.4.11 and 1.5.3 the MSRP templates are also made CSP safe, so child themes overriding Magento_Msrp/templates/popup.phtml or Magento_Msrp/templates/product/price/msrp.phtml need to update both templates together.
- Impact: Cross-Site Scripting (Storefront)
- Severity: Low
- Affected versions: >= 1.3.6 < 1.3.23, >= 1.4.0 < 1.4.11, >= 1.5.0 < 1.5.3
- Note: Exploiting this requires write access to product data, for example through the admin, a product import or the API. Because of the limited risk the fix ships with the regular releases and not as a separate patch release.
The Default Theme CSP is not affected, because its MSRP price template already passes the product name to Alpine through a JSON encoded data attribute.
Many thanks to Jelle Janssens (Singto BV) for reporting this issue!