CVE-2026-40887 Details
Description
Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.
A critical unauthenticated SQL injection vulnerability has been identified in the Vendure Shop API, affecting versions 1.7.4 prior to 2.3.4, as well as versions 3.0.0 prior to 3.5.7 and 3.6.0 prior to 3.6.2. The vulnerability arises because a user-controlled query string parameter is directly interpolated into a raw SQL expression without proper parameterization or validation. This flaw allows attackers to execute arbitrary SQL commands against the database. All supported database backends, including PostgreSQL, MySQL/MariaDB, and SQLite, are affected. While the Admin API is also vulnerable, exploitation there requires authentication.
Users are advised to upgrade to Vendure versions 2.3.4, 3.5.7, or 3.6.2, all of which contain the necessary patch. For those unable to upgrade immediately, a hotfix is available that validates the 'languageCode' input before it reaches the database query. This hotfix can be applied by modifying the 'getLanguageCode' method in the 'request-context.service.ts' file to include runtime validation of the 'languageCode' parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 21, 2026CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @vendure/core | >= 1.7.4, < 2.3.4 (semver) >= 3.0.0, < 3.5.7 (semver) >= 3.6.0, < 3.6.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |