CVE-2024-48914

This post is a research article published by EQSTLab. Thanks toRajesh Sharma, who discovered this vulnerability. CVE-2024-48914 ★ CVE-2024-48914 Arbitrary File Read and DoS PoC ★ Description CVE-2024-48914 : vendure-ecommerce Arbitrary file read and DoS Vulnerability description: Vendure is an...

Vendure Core - SQL Injection

Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or inp...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2026-63459

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:14+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5...

CVE-2026-63460

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:13+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7...

CVE-2026-63472

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

CVE-2026-63461

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63460

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

GHSA-6J36-R6PR-59X4 Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

External-authentication account takeover: external login linked to a pre-existing account by email without requiring verification Package: @vendure/core vendure-ecommerce/vendure, latest master · !IMPORTANT This vulnerability only affects deployments that use external / social authentication an...

GHSA-XF65-R35X-WMMV Vendure: Shop API list queries can return non-public entities when filterOperator is OR

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false. This injected guard was combined with the caller-supplied filter using the...

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

The Shop API products, collections and facets queries inject a mandatory filter to restrict results to publicly-visible entities Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false. This injected guard was combined with the caller-supplied filter using the...

GHSA-JGM3-QMP2-C4P7 Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Summary !IMPORTANT Only instances running on the SQLite driver better-sqlite3 are affected; SQLite is usually used in development/testing backend, so production deployments on PostgreSQL or MySQL/MariaDB are unaffected. The StringOperators.regex filter exposed on the public Shop GraphQL API is...

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Summary !IMPORTANT Only instances running on the SQLite driver better-sqlite3 are affected; SQLite is usually used in development/testing backend, so production deployments on PostgreSQL or MySQL/MariaDB are unaffected. The StringOperators.regex filter exposed on the public Shop GraphQL API is...

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

GHSA-XHQ9-WHGQ-49J5 Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

CVE-2026-63459

Vendure (open-source headless commerce platform) prior to 3.6.5 contains a stored XSS in its Admin Dashboard. The RichTextDescriptionCell component strips HTML by assigning an administrator-controlled description field to a live element's innerHTML and then reading textContent. This pattern still...

EUVD-2026-81670

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...