Vendurehq vulnerabilities
We track 4 vulnerabilities in Vendurehq products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Vendurehq vulnerabilities
- 9.1 Critical severity
vendure: Improper Authentication
Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by email
- 7.5 High severity
vendure: Inefficient Regular Expression Complexity
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-bui
- 8.7 High severity
vendure: Improper Neutralization of Input During Web Page Generation
Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled descripti
- 9.1 Critical severity
vendure: Improper Neutralization of Special Elements used in an SQL Command
Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolat