CVE-2026-25993
Published: 10 February 2026
Summary
CVE-2026-25993 is a critical-severity SQL Injection (CWE-89) vulnerability in Evershop Evershop. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25993 is a second-order SQL injection vulnerability in EverShop, a TypeScript-first eCommerce platform. The issue arises during category update and deletion event handling, where the application embeds path or request_path values—derived from the url_key field stored in the database—directly into SQL statements using string concatenation before passing them to an execute() function. This allows a malicious string in the url_key to alter the SQL statement during subsequent event processing, enabling arbitrary SQL execution. The vulnerability affects EverShop versions prior to v2.1.1 and has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-89.
Remote unauthenticated attackers can exploit this vulnerability by first storing a malicious payload in a category's url_key field, followed by triggering a category update or deletion event. Once injected, the payload executes during event processing, potentially allowing attackers to read sensitive data, modify database contents, or disrupt service availability with high impact on confidentiality, integrity, and availability.
Mitigation is available via a patch in EverShop starting from version v2.1.1, as detailed in the project's GitHub security advisory (GHSA-3h84-9rhc-j2ch) and the fixing commit (5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd). Security practitioners should prioritize updating affected deployments and review category management workflows for stored url_key values that could contain injectable payloads.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6749
Vulnerability details
EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derived from the url_key stored in the database—into SQL statements via string concatenation and passes them to execute(). As a result,…
more
if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct SQL injection in a public-facing web application (eCommerce platform) allowing unauthenticated remote arbitrary SQL execution matches T1190 exactly; secondary impacts (data access/modification) are too indirect for additional mappings.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the second-order SQL injection by requiring identification, reporting, and timely patching of the flaw as provided in EverShop v2.1.1.
Requires validation of url_key inputs to prevent storage of malicious SQL payloads in the database that enable second-order injection during category update or deletion events.
Vulnerability scanning identifies SQL injection flaws like CVE-2026-25993 in EverShop prior to exploitation.