{"id":"EUVD-2026-24274","enisaUuid":"337718ca-9b90-3509-87c9-204d9cd8fa91","description":"Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel\u0027s default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.","datePublished":"Apr 21, 2026, 7:24:59 PM","dateUpdated":"Apr 22, 2026, 1:41:11 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","references":"https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v\n","aliases":"CVE-2026-40887\nGHSA-9pp3-53p2-ww9v\n","assigner":"GitHub_M","epss":1.76,"enisaIdProduct":[{"id":"28afd4f9-e3ee-36f9-82b1-fc52455fa9f6","product":{"name":"vendure","vendor":{"name":"vendurehq"}},"product_version":"3.0.0, \u003c 3.5.7"},{"id":"73698c70-8a5d-3156-8934-58886b315ce9","product":{"name":"vendure","vendor":{"name":"vendurehq"}},"product_version":"1.7.4, \u003c 2.3.4"},{"id":"83814e09-7ce6-3bef-b5fd-b2e94141d248","product":{"name":"vendure","vendor":{"name":"vendurehq"}},"product_version":"3.6.0, \u003c 3.6.2"}],"enisaIdVendor":[{"id":"bad642b6-d2c8-39ec-8dd5-41f0475fcd8f","vendor":{"name":"vendurehq"}}],"enisaIdVulnerability":[{"id":"1b8bb65a-d023-364a-8456-2c0ce48ab990","vulnerability":{"id":"CVE-2026-40887","description":"Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel\u0027s default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.","datePublished":"Apr 21, 2026, 7:24:59 PM","dateUpdated":"Apr 22, 2026, 1:41:11 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","references":"https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v\n","enisa_id":"EUVD-2026-24274\n","assigner":"GitHub_M","epss":1.76,"dataProcessed":"Oct 30, 2026, 7:16:35 AM","vulnerabilityProduct":[{"id":"215f11a0-3aea-3c52-81f1-cb9da58a2038","product":{"name":"vendure","vendor":{"name":"vendurehq"}},"product_version":"3.0.0, \u003c 3.5.7"},{"id":"9980e40f-44f7-34a4-a9da-cb7fa42f0886","product":{"name":"vendure","vendor":{"name":"vendurehq"}},"product_version":"3.6.0, \u003c 3.6.2"},{"id":"aacaf68b-854a-34ed-ab5f-3afc2efb2c76","product":{"name":"vendure","vendor":{"name":"vendurehq"}},"product_version":"1.7.4, \u003c 2.3.4"}],"vulnerabilityVendor":[{"id":"d86d52c4-a98b-3162-a652-d6dfa9f09a5d","vendor":{"name":"vendurehq"}}]}},{"id":"4355f8ba-1f94-3c62-be71-01d0ec1ae862","vulnerability":{"id":"GHSA-9pp3-53p2-ww9v","description":"@vendure/core has a SQL Injection vulnerability","datePublished":"Apr 14, 2026, 10:38:01 PM","dateUpdated":"Apr 24, 2026, 9:10:15 PM","baseScore":0.0,"references":"https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40887\nhttps://github.com/vendurehq/vendure\n","enisa_id":"EUVD-2026-24274\n","aliases":"CVE-2026-40887\nGHSA-9pp3-53p2-ww9v\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}