Unauthenticated SQL Injection Vulnerability in Vendure Open-source Commerce Platform
CVE-2026-40887

9.1CRITICAL

Key Information:

Vendor

Vendurehq

Status
Vendure
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40887?

Vendure, the open-source headless commerce platform, is affected by an unauthenticated SQL injection vulnerability that enables attackers to execute arbitrary SQL commands on the database. This flaw arises from a user-controlled query string parameter being directly interpolated into raw SQL without proper parameterization or validation, potentially compromising all supported database backends including PostgreSQL, MySQL/MariaDB, and SQLite. While the Admin API is also vulnerable, exploitation requires authentication. The latest versions of Vendure have been patched, and for users unable to upgrade promptly, a hotfix is available that validates input before processing to mitigate the risk by blocking injection payloads and converting the SQL interpolation to a secure parameterized query.

Affected Version(s)

vendure >= 3.0.0, < 3.5.7 < 3.0.0, 3.5.7

vendure >= 3.6.0, < 3.6.2 < 3.6.0, 3.6.2

vendure >= 1.7.4, < 2.3.4 < 1.7.4, 2.3.4

References

https://github.com/vendurehq/vendure/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.