Executive brief
Vendure is an open-source e-commerce framework used to build online stores. An unauthenticated attacker can inject arbitrary SQL commands by manipulating a query parameter in the Shop API, potentially exposing or deleting sensitive customer and product data, or disrupting service availability. The vulnerability is trivial to exploit and affects all database types that Vendure supports.
Technical details
A SQL injection vulnerability exists in ProductService.findOneBySlug where the languageCode value from the HTTP request context is interpolated directly into a raw SQL CASE expression using a JavaScript template literal, bypassing TypeORM's parameterization. The languageCode originates from the query string and is cast to a TypeScript type at compile time but receives no runtime validation, allowing an attacker to inject SQL syntax. An unauthenticated attacker can append a crafted languageCode parameter to any Shop API request to execute arbitrary SQL against PostgreSQL, MySQL/MariaDB, or SQLite backends. The vulnerability has been patched in versions 2.3.4, 3.5.7, and 3.6.2 by adding input validation and converting the interpolation to a parameterized query.
Affected products
- Vendure @vendure/core >=1.7.4, <2.3.4; >=3.0.0, <3.5.7; >=3.6.0, <3.6.2
Timeline
- 2026-04-13: disclosed
- 2026-04-14: patched: Patched versions 2.3.4, 3.5.7, and 3.6.2 released