vendure
v3.8.2Open-source headless commerce platform built with TypeScript, NestJS, React, and GraphQL
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- OtherUnknown
- Security
- 30 advisories8 critical, 10 high, 8 medium, 4 low
- Supported versions
- No scheduleendoflife.date does not track this project
8.6k stars · 1.6k forks · 237 open issues · last release 3 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 8 critical, 10 high, 8 medium, 4 low. Check the patched version against the one you run.
- lowGHSA-fw8w-3xpv-rg9pOct 23, 2026Unauthenticated path traversal file-existence oracle in GraphiQL plugin asset server
- Affected
- < 3.7.4
- lowGHSA-qmrg-wpxj-c482Oct 23, 2026GraphQL API error responses include stack traces unless NODE_ENV is production
- Affected
- >= 2.1.0, < 3.7.4
- Patched in
- 3.7.4
- highGHSA-hxvp-ff3g-qcj7Oct 23, 2026Low-privilege administrator can read password-reset / verification / email-change tokens from Job.data and take over any customer account (cross-channel)
- Affected
- < 3.7.5
- lowGHSA-8ghm-q833-cmgpOct 5, 2026Stock Level Race Condition Allows Inventory Overselling via Concurrent Checkout
- Affected
- < 3.7.4
- Patched in
- 3.7.4
- highGHSA-37xp-mjp8-6f9xOct 5, 2026`rotateApiKey` performs no ownership / permission-subset check and returns the new plaintext secret, so an admin holding only `UpdateApiKey` can rotate a higher-privileged API key and hijack a live credential for it (vertical privilege escalation)
- Affected
- >= 3.6.0, < 3.7.4
- Patched in
- 3.7.4
- mediumGHSA-7g8c-5hg8-348mSep 30, 2026AISLE-2026-0093 Missing channel scoping in TranslatableSaver.update allows cross-channel entity mutation by restricted administrators
- Affected
- < 3.6.5
- Patched in
- 3.6.5
- highGHSA-5fpx-9m35-w745Sep 30, 2026Authenticated session is not bound to its API audience (cross-context session replay)
- Affected
- < 3.8.0
- Patched in
- 3.8.0
- highGHSA-32jm-mf7r-7qw5Sep 2, 2026RequestContext serialization persists session token and request headers into job data
- Affected
- >= 1.4.0, < 3.7.3
- Patched in
- 3.7.3
- mediumGHSA-f4r3-h6jf-4m29Sep 2, 2026Stored XSS via SVG upload in `@vendure/asset-server-plugin`
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- mediumGHSA-c63h-3vvx-48phSep 2, 2026Incomplete fix for GHSA-6f65-4fv2-wwch: verifyUserPassword still returns early for users with no NativeAuthenticationMethod
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- mediumGHSA-vr2h-89r2-9rwvSep 2, 2026Permissive CORS default allows any origin to make credentialed cross-origin requests
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- mediumGHSA-gg28-cx38-jxxrSep 2, 2026Vendure createProductOption missing channel scoping allows cross-channel ProductOptionGroup writes
- Affected
- >= 3.6.0, < 3.7.3
- Patched in
- 3.7.3
- highGHSA-37j3-p93w-fq6wSep 2, 2026Channel-scoped administrators can read the global administrator directory via the Admin API
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- highGHSA-f94w-2928-x43pSep 2, 2026Cross-channel data disclosure — duplicateEntity copies entities from channels the caller cannot access
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- criticalGHSA-wr5h-x3x6-4h23Sep 2, 2026Unauthenticated account takeover of external/SSO customers via registerCustomerAccount (native-side sibling of GHSA-6j36)
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- criticalGHSA-22x4-937q-5fr5Sep 2, 2026Any Administrator with UpdateChannel/DeleteChannel permission can rename or permanently delete any Channel in the system, including ones they have no relationship to at all
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- criticalGHSA-422x-jq57-j238Sep 2, 2026Any Administrator with UpdateCatalog or UpdateProduct permission can pull a Product belonging to a completely different Channel into their own Channel, gaining full ongoing edit and delete control over it
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- criticalGHSA-7qvr-c5vf-xxfhSep 2, 2026Cross-channel payment/refund IDOR — money movement across tenants (payment-side sibling of GHSA-frwg)
- Affected
- < 3.7.3
- Patched in
- 3.7.3
- highGHSA-88rq-mq4v-frmmAug 24, 2026File upload MIME type bypass allows uploading arbitrary file types via Content-Type header manipulation
- Affected
- <= 3.6.4
- Patched in
- 3.6.5
- mediumGHSA-rgjm-ff27-p2hfAug 6, 2026Cross-channel write IDOR in AssetService.update and StockLocationService.update (missing channel scoping)
- Affected
- < 3.7.2
- Patched in
- 3.7.2
- mediumGHSA-fp4j-ff6j-9793Aug 6, 2026Cross-channel destructive-write IDOR in PromotionService.softDeletePromotion, FacetValueService.delete, and ProductOptionService.delete (missing active-channel scoping)
- Affected
- < 3.7.2
- Patched in
- 3.7.2
- criticalGHSA-v85r-wfgv-jcqcAug 3, 2026Privilege escalation to SuperAdmin via updateAdministrator password reset
- Affected
- <= 3.7.1
- Patched in
- 3.7.2
- highGHSA-hc75-2v4j-x372Aug 3, 2026Broken Access Control — adjustDraftOrderLine is reachable by unauthenticated users (Vendure)
- Affected
- <= 3.7.1
- Patched in
- 3.7.2
- criticalCVE-2026-63472Jul 1, 2026External-authentication account takeover: external login linked to a pre-existing account by email without verification
- Affected
- < 3.7.0
- Patched in
- 3.7.0
- mediumCVE-2026-63461Jul 1, 2026Shop API list queries can return non-public entities when filterOperator is OR
- Affected
- >= 1.0.0
- Patched in
- 3.6.5
- highCVE-2026-63460Jul 1, 2026Unauthenticated ReDoS via `regex` filter on SQLite backends
- Affected
- <=3.6.4
- Patched in
- 3.6.5
- highCVE-2026-63459Jul 1, 2026Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
- Affected
- latest / all current
- Patched in
- 3.6.5
- criticalCVE-2026-40887Apr 13, 2026Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in @vendure/core
- Affected
- >=1.7.4, <2.3.4; >=3.0.0, <3.5.7; >=3.6.0, <3.6.2
- Patched in
- 2.3.4; 3.5.7; 3.6.2
- lowCVE-2026-25050Jan 30, 2026Timing attack enables user enumeration in NativeAuthenticationStrategy
- Affected
- <= 3.5.2
- Patched in
- 3.5.3
- criticalCVE-2024-48914Oct 15, 2024Local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
- Affected
- <3.0.5, <2.3.3
- Patched in
- 3.0.5, 2.3.3