CVE-2026-40887 in vendure
Summary
by MITRE • 04/21/2026
Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/05/2026
This vulnerability represents a critical security flaw in the Vendure commerce platform that affects multiple version ranges across different major releases. The issue stems from improper input validation and sanitization within the Shop API and Admin API components where user-controlled parameters are directly interpolated into raw SQL queries without proper parameterization or validation mechanisms. This vulnerability type falls under CWE-89 which specifically addresses SQL injection flaws, making it a well-documented and highly dangerous class of vulnerability that can lead to complete database compromise.
The technical implementation of this flaw occurs when query string parameters are processed through the request handling pipeline without adequate sanitization or parameter binding. The affected code path allows attackers to inject malicious SQL payloads through controlled input parameters, enabling them to execute arbitrary database commands against all supported database backends including PostgreSQL, MySQL/MariaDB, and SQLite. This cross-platform impact amplifies the severity since the same vulnerability exists across multiple database systems that organizations might be using in their infrastructure.
The operational impact of this vulnerability is significant as it enables unauthenticated attackers to exploit the Shop API directly without requiring any valid credentials, making it particularly dangerous for publicly accessible commerce platforms. Attackers can potentially extract sensitive customer data, modify product catalogs, manipulate order information, or even escalate privileges within the database environment. The fact that the Admin API is also affected but requires authentication adds another dimension of risk since authenticated attackers with appropriate permissions could leverage this vulnerability to perform more sophisticated attacks.
Organizations running affected versions face immediate security risks and should prioritize upgrading to patched releases 2.3.4, 3.5.7, and 3.6.2 which implement proper parameterized queries as a defense-in-depth approach. For those unable to upgrade immediately, the provided hotfix offers a viable interim solution by validating language code inputs at the request boundary using RequestContextService.getLanguageCode method. This approach follows ATT&CK technique T1078.004 for credential dumping prevention and demonstrates proper input validation practices. The hotfix works by silently dropping invalid values and reverting to default channel language settings, effectively blocking injection payloads before they reach database query execution layers. The patched implementations also convert vulnerable SQL interpolation patterns to parameterized queries which provides additional protection against similar vulnerabilities in the future. Organizations should consider implementing additional monitoring for unusual API access patterns and database query activity as part of their overall security posture while applying these patches.