CVE-2026-40887
Critical@vendure/core has a SQL Injection vulnerability
Published Apr 14, 2026 · Updated Aug 12, 2026 · Also known as GHSA-9pp3-53p2-ww9v
Key Facts
Patch in the next maintenance window- CVE-2026-40887 is a critical-severity vulnerability (CVSS 9.1 v3.1) affecting @vendure/core (npm), vendure.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 2.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including @vendure/core 2.3.4, @vendure/core 3.5.7, @vendure/core 3.6.2.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS (30-day exploit likelihood)
2.2%
Higher than 82.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-40887 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses RequestContextService.getLanguageCode to validate the languageCode input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing getLanguageCode method in packages/core/src/service/helpers/request-context/request-context.service.ts. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| @vendure/corenpm | >= 3.0.0 | 3.5.7 |
| vendure | >= >= 3.0.0, < 3.5.7 | n/a |
Patched Releases
@vendure/core
2.3.4, 3.5.7, 3.6.2
Timeline
Publicly disclosed
Apr 14, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
FAQ
Common Questions.
Vendure is an open-source headless commerce platform.
Affected: @vendure/core (npm) versions >= 3.0.0; vendure versions >= >= 3.0.0, < 3.5.7. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including @vendure/core 2.3.4, @vendure/core 3.5.7, @vendure/core 3.6.2.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-40887 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo