CVE-2026-25993

Critical

Published: 10 February 2026

Published

10 February 2026

Modified

23 February 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0004 13.2th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25993 is a critical-severity SQL Injection (CWE-89) vulnerability in Evershop Evershop. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the second-order SQL injection by requiring identification, reporting, and timely patching of the flaw as provided in EverShop v2.1.1.

SI-10 Information Input Validation good match

prevent

Requires validation of url_key inputs to prevent storage of malicious SQL payloads in the database that enable second-order injection during category update or deletion events.

RA-5 Vulnerability Monitoring and Scanning partial match

detect

Vulnerability scanning identifies SQL injection flaws like CVE-2026-25993 in EverShop prior to exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct SQL injection in a public-facing web application (eCommerce platform) allowing unauthenticated remote arbitrary SQL execution matches T1190 exactly; secondary impacts (data access/modification) are too indirect for additional mappings.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result,…

if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.

Deeper analysisAI

CVE-2026-25993 is a second-order SQL injection vulnerability in EverShop, a TypeScript-first eCommerce platform. The issue arises during category update and deletion event handling, where the application embeds path or request_path values—derived from the url_key field stored in the database—directly into SQL statements using string concatenation before passing them to an execute() function. This allows a malicious string in the url_key to alter the SQL statement during subsequent event processing, enabling arbitrary SQL execution. The vulnerability affects EverShop versions prior to v2.1.1 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-89.

Remote unauthenticated attackers can exploit this vulnerability by first storing a malicious payload in a category's url_key field, followed by triggering a category update or deletion event. Once injected, the payload executes during event processing, potentially allowing attackers to read sensitive data, modify database contents, or disrupt service availability with high impact on confidentiality, integrity, and availability.

Mitigation is available via a patch in EverShop starting from version v2.1.1, as detailed in the project's GitHub security advisory (GHSA-3h84-9rhc-j2ch) and the fixing commit (5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd). Security practitioners should prioritize updating affected deployments and review category management workflows for stored url_key values that could contain injectable payloads.