CVE-2026-40887

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses `RequestContextService.getLanguageCode` to validate the `languageCode` input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing `getLanguageCode` method in `packages/core/src/service/helpers/request-context/request-context.service.ts`. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.

• CWE-89

• https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40881ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-40882OpenRemote is an open-source internet-of-things platform. Pr…7.6
• CVE-2026-40883goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4…8.1
• CVE-2026-40884goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-40885goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4…8.8
• CVE-2026-40886Argo Workflows is an open source container-native workflow e…7.7
• CVE-2026-40888Frappe HR is an open-source human resources management solut…6.5
• CVE-2026-40889Frappe HR is an open-source human resources management solut…6.5
• CVE-2026-4089The Twittee Text Tweet plugin for WordPress is vulnerable to…6.4
• CVE-2026-40890The package `github.com/gomarkdown/markdown` is a Go library…7.5
• CVE-2026-40891OpenTelemetry dotnet is a dotnet telemetry framework. From 1…5.3
• CVE-2026-40892PJSIP is a free and open source multimedia communication lib…9.8