GHSA-5j4h-4f72-qpm6 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

• Packagist bagisto/bagisto: < 2.3.10 → fixed in 2.3.10

Summary SSTI when normal customer orders any product in add address step can inject value run in admin view. Details `As normal user` 1. Go to `http://127.0.0.1:8000/` 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{7*7}} in any input `As admin` 1. Go to `http://127.0.0.1:8000/admin/sales/orders` 2. And notice the vlaue appear in admin view 49 `As normal user` 3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49 PoC • Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d Impact • Can lead to RCE