vendurehq/vendure Security Advisories | GitStock

critical2026-09-17

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

GHSA-6j36-r6pr-59x4 · CVE-2026-63472

medium2026-09-17

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

GHSA-xf65-r35x-wmmv · CVE-2026-63461

high2026-09-17

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

GHSA-jgm3-qmp2-c4p7 · CVE-2026-63460

high2026-09-17

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

GHSA-xhq9-whgq-49j5 · CVE-2026-63459

critical2026-04-14

@vendure/core has a SQL Injection vulnerability

GHSA-9pp3-53p2-ww9v · CVE-2026-40887

low2026-01-30

Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

GHSA-6f65-4fv2-wwch · CVE-2026-25050