Skip to content
OpenAdvisories

Package · npm

@vendure/core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-63472

    Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

    Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emai…

    vendurehq vendure @vendure/core npm
  • Critical 9.1
    CVE-2026-40887 Scanner template

    @vendure/core has a SQL Injection vulnerability

    Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpola…

    vendurehq vendure @vendure/core npm