---
title: "CVE-2026-40887: @vendure/core has a SQL Injection vulnerability"
url: https://erroneo.us/security/cve/CVE-2026-40887/
description: "CVE-2026-40887 (@vendure/core (npm)): Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-04-21
date_modified: 2026-04-24
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-40887"
kev: false
cvss: 9.1
epss: 0.02202
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-40887: @vendure/core has a SQL Injection vulnerability

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 2.2% , percentile 82: FIRST’s model estimates a 2.2% chance of exploitation activity in the next 30 days, higher than 82% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes @vendure/core (npm) >= 3.0.0, < 3.5.7, fixed in 3.5.7 ; @vendure/core (npm) >= 3.6.0, < 3.6.2, fixed in 3.6.2 ; @vendure/core (npm) >= 1.7.4, < 2.3.4, fixed in 2.3.4 . Check your lockfile, including transitive dependencies.

## What it is

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected, though exploitation there requires authentication. Versions 2.3.4, 3.5.7, and 3.6.2 contain a patch. For those who are unable to upgrade immediately, Vendure has made a hotfix available that uses RequestContextService.getLanguageCode to validate the languageCode input at the boundary. This blocks injection payloads before they can reach any query. The hotfix replaces the existing getLanguageCode method in packages/core/src/service/helpers/request-context/request-context.service.ts. Invalid values are silently dropped and the channel's default language is used instead. The patched versions additionally convert the vulnerable SQL interpolation to a parameterized query as defense in depth.

## Affected packages

- npm `@vendure/core` >= 3.0.0, < 3.5.7 → fixed: 3.5.7
- npm `@vendure/core` >= 3.6.0, < 3.6.2 → fixed: 3.6.2
- npm `@vendure/core` >= 1.7.4, < 2.3.4 → fixed: 2.3.4

## Affected products (CVE record)

- vendurehq vendure: >= 3.0.0, < 3.5.7, >= 3.6.0, < 3.6.2, >= 1.7.4, < 2.3.4

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 2.20% probability of exploitation activity in the next 30 days; percentile 82.

## Sources

- [GitHub Advisory GHSA-9pp3-53p2-ww9v](https://github.com/advisories/GHSA-9pp3-53p2-ww9v)
- [CVE.org record CVE-2026-40887](https://www.cve.org/CVERecord?id=CVE-2026-40887)
- [NVD entry CVE-2026-40887](https://nvd.nist.gov/vuln/detail/CVE-2026-40887)
- [github.com](https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v)

---
Source page: https://erroneo.us/security/cve/CVE-2026-40887/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt