Skip to content
OpenAdvisories

Package · npm

@vendure/core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 5.3
    CVE-2026-63461

    Vendure: Shop API list queries can return non-public entities when filterOperator is OR

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperato…

    vendurehq vendure @vendure/core npm
  • Critical 9.1
    CVE-2026-63472

    Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

    Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emai…

    vendurehq vendure @vendure/core npm
  • High 7.5
    CVE-2026-63460

    Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-bu…

    vendurehq vendure @vendure/core npm
  • Critical 9.1
    CVE-2026-40887 Scanner template

    @vendure/core has a SQL Injection vulnerability

    Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpola…

    vendurehq vendure @vendure/core npm
  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm
  • Medium 5.3
    GHSA-wm63-7627-ch33

    @vendure/core's insecure currencyCode handling allows wrong payment amounts

    ### Impact Currently, in many Vendure deployments it's possible to select any currencyCode (really any, doesn't need to be assigned to the channel) and pay through Mollie and Stripe in that particular currencyCode. The prices are not transformed. The result i…

    @vendure/core npm
  • Low —
    GHSA-h9wq-xcqx-mqxm

    Vendure Cross Site Request Forgery vulnerability impacting all API requests

    ### Impact Vendure is an e-commerce GraphQL framework with a number of APIs and different levels of authorization. By default the Cookie settings are insecure, having the SameSite setting as false which results in not having one (originates from the cookie-se…

    @vendure/core npm