CVE Intelligence
Analysis AI-assisted

CVE-2026-40887: Vendure Core SQL Injection in Shop API

Vendure Core contains an unauthenticated SQL injection in the Shop API, rated Critical with a CVSS 3.1 score of 9.1 by the GitHub CNA. The record lists affected ranges from 1.7.4 before 2.3.4, from 3.0.0 before 3.5.7, and from 3.6.0 before 3.6.2, and upgrading to patched releases is the primary remedy. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Vendure is an open-source headless commerce platform. CVE-2026-40887 describes an unauthenticated SQL injection in the Shop API, mapped to CWE-89. A user-controlled query string parameter is placed into a raw SQL expression without parameterization or validation.

Impact

  • The advisory states that an attacker could execute arbitrary SQL against the database.
  • The record states that all supported database backends are affected: PostgreSQL, MySQL/MariaDB and SQLite.
  • The GitHub CNA scoring is CVSS 3.1 9.1 Critical, with high confidentiality and availability impact and no integrity impact.

Affected products and versions

  • Product listed as Vendurehq Vendure.
  • Affected ranges in the record: version 1.7.4 up to but excluding 2.3.4; version 3.0.0 up to but excluding 3.5.7; version 3.6.0 up to but excluding 3.6.2.
  • The description states that the Admin API is also affected, but exploitation there requires authentication.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalogue. No confirmed exploitation appears in the sources consulted. The SSVC exploitation value in the record is none, and the EPSS probability is 0.02202.

Remediation and mitigation

  • Upgrade to 2.3.4, 3.5.7 or 3.6.2, depending on your release line.
  • If an immediate upgrade is not possible, the advisory describes a hotfix that validates the language code input at the request boundary by replacing the getLanguageCode method in the request context service. Invalid values fall back to the channel default language.
  • Test the hotfix in a non-production environment before deployment, since the record does not state whether it covers every injection path.
  • Limit public exposure of administrative and database-facing components where operationally feasible.

Detection guidance

  • Review web server and application logs for Shop API requests with unusual or malformed values in language or query string parameters.
  • Monitor application logs for database error messages that reference SQL syntax originating from front-end requests.
  • Watch for unexpected increases in database queries or data access patterns tied to the Shop API.

Limitations of the available information

  • The record's fixes list is empty, but the description identifies the patched versions. An empty field does not mean no fix exists.
  • The record source status is Deferred.
  • No exploit details, indicators of compromise or proof-of-concept material are included in the sources consulted, and none are reproduced here.
  • The EPSS entry carries a date of 2026-10-13, which is later than the published date; treat the probability with care.

Sources: GitHub security advisory and NVD entry.

Frequently asked questions

Which Vendure versions are affected by CVE-2026-40887?

The record lists affected ranges from 1.7.4 before 2.3.4, from 3.0.0 before 3.5.7, and from 3.6.0 before 3.6.2. Check your installed version against these ranges.

Is this vulnerability being exploited in the wild?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none.

What should I do if I cannot upgrade immediately?

The advisory describes a hotfix that validates the language code input at the request boundary. Test it before deployment, because the record does not confirm it covers every injection path.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.