CVE-2026-40887

Deeper analysis

Vendure is an open-source headless commerce platform that contains an unauthenticated SQL injection vulnerability in its Shop API. The flaw, present from version 1.7.4 through versions prior to 2.3.4, 3.5.7, and 3.6.2, arises when a user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation. It affects all supported database backends including PostgreSQL, MySQL/MariaDB, and SQLite; the Admin API is also impacted, though exploitation there requires prior authentication. The issue is tracked as CWE-89 with a CVSS score of 9.1.

An attacker can supply a malicious languageCode or similar parameter in requests to the Shop API and thereby execute arbitrary SQL against the underlying database, potentially extracting sensitive data or causing denial of service. Because the vector is unauthenticated and network-reachable, exploitation requires no credentials or user interaction.

The referenced GitHub Security Advisory states that patched releases convert the vulnerable interpolation to a parameterized query. For environments that cannot upgrade immediately, Vendure provides a hotfix that replaces the getLanguageCode method in RequestContextService to validate the languageCode input at the request boundary, silently dropping invalid values and falling back to the channel default. The EPSS score has remained flat at 0.0770 with no material increase observed after disclosure.