Skip to content
OpenAdvisories

Package · npm

@vendure/core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-63460

    Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-bu…

    vendurehq vendure @vendure/core npm