Skip to content
OpenAdvisories

Vendor

vendurehq

7 known vulnerabilities.

Products

vendure 7
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-63459

    Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled descript…

    vendurehq vendure @vendure/dashboard npm
  • High 7.5
    CVE-2026-63460

    Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

    Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-bu…

    vendurehq vendure @vendure/core npm