CVE-2026-40887

9.1

Vendure · Vendure

An unauthenticated SQL injection vulnerability in the Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the backend database.

Executive summary

An unauthenticated SQL injection vulnerability in the Vendure Shop API permits remote attackers to execute arbitrary database queries, leading to potential unauthorized data access or modification.

Vulnerability

Input validation failure in the Shop API allows unauthenticated users to inject malicious SQL into query string parameters, which are processed without sufficient sanitization.

Business impact

This vulnerability carries a CVSS score of 9.1, indicating a critical risk to business operations. Exploitation could result in the exfiltration of sensitive customer data, unauthorized administrative access, or complete database corruption, causing significant reputational and operational harm.

Remediation

Immediate Action: Upgrade to versions 2.3.4, 3.5.7, or 3.6.2 depending on your current deployment branch.

Proactive Monitoring: Review database query logs for syntax errors, unexpected union selects, or signs of reconnaissance activity targeting the Vendure Shop API.

Compensating Controls: Apply the provided vendor hotfix to the RequestContextService to validate languageCode inputs, or implement a WAF rule to block suspicious SQL injection patterns in query strings.

Exploitation status

Public Exploit Available: No

Analyst recommendation

Given the ease of exploitation and the potential for total database compromise, organizations must apply the provided patches or hotfixes immediately. Ensure all database backends (PostgreSQL, MySQL, SQLite) are protected by the updated validation logic.

Deep Dive #15

Am I vulnerable, and what should I do?

Operational write-up published 2026-07-17. Detection rules are starter content — validate before deploying.

Am I vulnerable?

CVE-2026-40887 is an unauthenticated SQL injection in the Vendure Shop API. Vendure is an open-source headless commerce platform (Node.js/TypeScript), and the Shop API is its public storefront API, so this is internet-facing and requires no login. A user-controlled query-string parameter is interpolated directly into a raw SQL expression with no parameterization, letting an attacker run arbitrary SQL against the store's database. NVD scores it CVSS 9.1 CRITICAL, and a public nuclei detection template already exists, so treat any exposed unpatched store as a live target.

Affected versions

Vendure ships three supported branches, each with its own fix:

Branch	Vulnerable range	Fixed in
1.x / 2.x	1.7.4 ≤ version < 2.3.4	2.3.4
3.0 to 3.5	3.0.0 ≤ version < 3.5.7	3.5.7
3.6	3.6.0 ≤ version < 3.6.2	3.6.2

Diagnostic checks (read-only)

Version: check @vendure/core in package.json or run npm ls @vendure/core. Map it to the table above. Below your branch's fix is vulnerable.
Is the Shop API exposed?: the Shop API is public by design (default path /shop-api). If the store is reachable from the internet, the vulnerable surface is reachable.
Post-compromise triage (read-only): review database and application logs for Shop API requests carrying SQL metacharacters or boolean/time-based patterns (' OR , UNION SELECT, SLEEP(, pg_sleep), unusual query errors, and unexpected spikes in slow queries or row counts from the Shop API's data source.

Vulnerability

This is a textbook CWE-89. Vendure's Shop API takes a value from a request query string and concatenates it into a raw SQL expression rather than binding it as a parameter, so an attacker controls part of the executed SQL. Because the Shop API authenticates nothing for public storefront reads, the injection is reachable pre-auth. NVD's vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H: network-reachable, low-complexity, no privileges, no user interaction, with high confidentiality and availability impact.

The severity here is amplified by what a commerce database holds and by how exposed the surface is. Every Vendure storefront exposes the Shop API, so this is not a niche admin endpoint. The nuclei template means commodity scanners can fingerprint and probe vulnerable stores at scale within days of disclosure, which is the point at which an old-but-unpatched instance gets found. EPSS has stayed low (around 1.8%) because that is a lagging, model-based signal; the operational signal is the public tooling plus the pre-auth, internet-facing shape.

Threat model

Who would exploit this: opportunistic mass-scanners and data thieves. The nuclei template lowers the barrier to point-and-scan, and commerce databases are a direct monetization target. Card-skimming and Magecart-style operators also prize any foothold in an e-commerce backend.

What they're after:

Exfiltrate the commerce database: customer PII (names, emails, addresses, phone numbers), order history, and administrator account records including password hashes
Depending on the database engine and privileges, escalate the SQL primitive to file read/write or code execution, or cause denial of service (the A:H impact)
Use stolen customer and order data for fraud, extortion, or resale, and use admin hashes to pivot into the store's back office

Attack chain: fingerprint a Vendure store (the Shop API is recognizable), send a crafted query-string value to the injectable parameter, and read arbitrary tables via boolean, time-based, or UNION techniques. From dumped admin hashes or session data, pivot toward the Admin API and full store takeover.

Blast radius: the entire commerce dataset is at risk of disclosure, and the availability impact means an attacker can also degrade or corrupt the store's database. For a merchant this is customer-data breach territory with the attendant disclosure obligations, plus direct revenue loss if the store is taken down.

Mitigation

Patch

Upgrade to the fix for your branch: 2.3.4, 3.5.7, or 3.6.2. This is a drop-in patch release within each branch, so it should be low-risk to apply quickly.

Branch	Fixed version
1.x / 2.x	2.3.4
3.0 to 3.5	3.5.7
3.6	3.6.2

Compensating controls

Until you can patch:

WAF rule on the Shop API. Block requests to the Shop API path whose query parameters contain SQL metacharacters or classic injection patterns. This is a stopgap, not a fix, since WAF SQLi rules are bypassable.
Least-privilege database user. Ensure the Vendure application's database account has only the rights it needs (no superuser, no file or command functions), which caps how far an injection can go.
Restrict exposure where possible. If a given deployment does not need a public storefront, put the Shop API behind authentication or network controls until patched.
Rotate secrets after patching if you have any reason to believe the store was probed, since admin hashes and session material may have been read.

Detection (starter rules, validate before deploying)

Unlike an on-device or protocol-internal bug, this one is HTTP-facing, so web-log detection applies directly.

Network and log signals

Shop API requests whose query parameters contain SQL metacharacters or injection idioms (', --, UNION, SELECT, SLEEP(, pg_sleep(, OR 1=1).
Database-side signals: sudden slow queries, SQL syntax errors, or large result sets originating from the Shop API's connection.

Sigma

title: Vendure Shop API SQL Injection Attempt (CVE-2026-40887)
id: 3f6a1c92-7b04-4e2d-9a51-vendure40887
status: experimental
description: Requests to the Vendure Shop API carrying SQL-injection patterns in the query string. Tune the path to your Shop API route.
references:
  - https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v
logsource:
  category: webserver
detection:
  shop_api:
    cs-uri-path|contains: '/shop-api'
  sqli_markers:
    cs-uri-query|contains:
      - 'union select'
      - "' or "
      - 'sleep('
      - 'pg_sleep('
      - '/*'
      - '0x'
  condition: shop_api and sqli_markers
fields:
  - c-ip
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate storefront queries rarely contain these tokens; tune to your traffic.
level: high

Rule notes

Scope cs-uri-path to your actual Shop API route if it differs from the /shop-api default.
A WAF or proxy that can inspect the decoded query string catches more than raw access logs, since attackers URL-encode payloads. Decode before matching.
Pair the network rule with database-side monitoring: an injection that uses boolean or time-based extraction may look benign per-request but stands out as a burst of near-identical queries.

References

Vendure security advisory GHSA-9pp3-53p2-ww9v: https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v
Vendure project: https://github.com/vendurehq/vendure