Vendure Core - SQL Injection

Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or inp...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2024-48914

This post is a research article published by EQSTLab. Thanks toRajesh Sharma, who discovered this vulnerability. CVE-2024-48914 ★ CVE-2024-48914 Arbitrary File Read and DoS PoC ★ Description CVE-2024-48914 : vendure-ecommerce Arbitrary file read and DoS Vulnerability description: Vendure is an...

CVE-2026-63459

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:14+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5...

CVE-2026-63460

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:13+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7...

CVE-2026-63472

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

CVE-2026-63460

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

CVE-2026-63461

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

GHSA-6J36-R6PR-59X4 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-63472 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-63472 Source advisory: GHSA-6J36-R6PR-59X4...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-63472 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-63472 Source advisory: OSV:GHSA-6J36-R6PR-59X4...

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +94 more potentially affected by CVE-2026-63461 via @vendure/core (>=1.9.5, <=3.4.4)

@vendure/core NPM version =1.9.5, =1.0.0, =1.0.4, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.2.4 and more Source cves: CVE-2026-63461 Source advisory: OSV:GHSA-XF65-R35X-WMMV...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +94 more potentially affected by CVE-2026-63461 via @vendure/core (>=1.9.5, <=3.4.4)

@vendure/core NPM version =1.9.5, =1.0.0, =1.0.4, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.2.4 and more Source cves: CVE-2026-63461 Source advisory: GHSA-XF65-R35X-WMMV...

GHSA-XF65-R35X-WMMV Vendure: Shop API list queries can return non-public entities when filterOperator is OR

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false. This injected guard was combined with the caller-supplied filter using the...

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false. This injected guard was combined with the caller-supplied filter using the...

GHSA-JGM3-QMP2-C4P7 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Summary !IMPORTANT Only instances running on the SQLite driver better-sqlite3 are affected; SQLite is usually used in development/testing backend, so production deployments on PostgreSQL or MySQL/MariaDB are unaffected. The StringOperators.regex filter exposed on the public Shop GraphQL API is...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-63460 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-63460 Source advisory: OSV:GHSA-JGM3-QMP2-C4P7...

@semic/testing (2.2.11), @vendure/dashboard (>=3.2.2, <=3.4.4) potentially affected by CVE-2026-63460 via @vendure/core (>=3.0.0, <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-63460 Source advisory: GHSA-JGM3-QMP2-C4P7...