CVE-2026-40887 @vendure/core has a SQL Injection vulnerability
Unauthenticated attackers can execute arbitrary SQL commands via the Shop API, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40887?
CVE-2026-40887 is a critical SQL injection vulnerability in vendurehq vendure, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.
Weakness: CWE-89
Which versions are affected by CVE-2026-40887?
6 open source packages ship an affected version, including @vendure/core.
| Package | Affected | Fixed in |
|---|---|---|
@vendure/core npm | From 1.7.4 | 2.3.4 |
@vendure/core npm | From 1.7.4 | 2.3.4 |
@vendure/core npm | From 3.0.0 | 3.5.7 |
@vendure/core npm | From 3.0.0 | 3.5.7 |
@vendure/core npm | From 3.6.0 | 3.6.2 |
@vendure/core npm | From 3.6.0 | 3.6.2 |
How do I fix CVE-2026-40887?
Upgrade @vendure/core to a fixed version for your release line: 2.3.4, 3.5.7 or 3.6.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-40887 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40887 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-9pp3-53p2-ww9v.