CVE-2026-63460
HighCVSS 7.5Summary
Vendure prior to 3.6.5 allows an unauthenticated caller to supply a catastrophically backtracking regular expression pattern through StringOperators.regex in the public Shop GraphQL API. Deployments using better-sqlite3 and sqljs evaluate the pattern synchronously in the Node.js event loop, which can block request processing. The issue is fixed in version 3.6.5.
Risk Assessment
A single malicious request can block the storefront and admin API, and repeated requests can sustain a denial of service. PostgreSQL and MySQL/MariaDB deployments do not execute this regular expression in the Node.js event loop.
Recommendation
Upgrade Vendure to version 3.6.5 or later. If that is not possible, consider restricting access to the public Shop API or migrating to PostgreSQL/MySQL.
Other vulnerabilities in Vendure
See all- CVE-2026-63461Medium
In Vendure prior to 3.6.5, public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden entity can bypass the Product.enabled, Collection.isPrivate, or Facet.isPrivate guard. An unauthenticated caller can therefore retrieve disabled products and private collections or facets.
- CVE-2026-63459High
Vendure prior to 3.6.5 contains a stored XSS vulnerability in RichTextDescriptionCell, which assigns an administrator-controlled description to a live element's innerHTML and then reads textContent. Active resource markup can execute an event handler during the innerHTML assignment before textContent is read. A lower-privilege administrator can store such markup in descriptions rendered by the Products, Collections, Promotions, Payment Methods, or Shipping Methods lists, and script executes when another administrator views the affected row.
- CVE-2026-67347Medium
A vulnerability in Vendure (up to version 3.7.1) allows channel-scoped administrators to modify other tenants' data by bypassing channel isolation validation. The attack involves supplying global IDs of StockLocation or Asset entities from different channels.
- CVE-2026-63472Critical
In Vendure, the createCustomerAndUser function in external authentication matches an existing customer by email address and attaches a new external authentication method without requiring verification. An attacker can use an unverified email to hijack the victim's account.
Original NVD description (English source)
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.