CVE-2026-40887: Vendure Commerce Platform SQLi Vulnerability

CVE-2026-40887 Overview

CVE-2026-40887 is a critical SQL Injection vulnerability affecting Vendure, an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends including PostgreSQL, MySQL/MariaDB, and SQLite. The Admin API is also affected, though exploitation there requires authentication.

Critical Impact

Unauthenticated attackers can execute arbitrary SQL commands against the database, potentially leading to complete database compromise, data exfiltration, data manipulation, and denial of service across all supported database backends.

Affected Products

• Vendure versions 1.7.4 through 2.3.3
• Vendure versions 3.5.0 through 3.5.6
• Vendure versions 3.6.0 through 3.6.1

Discovery Timeline

• 2026-04-21 - CVE-2026-40887 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40887

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), one of the most dangerous web application security flaws. The core issue lies in how the Vendure Shop API handles the languageCode query parameter. Instead of using parameterized queries or proper input validation, the user-supplied value is directly interpolated into raw SQL expressions.

The vulnerability is particularly severe because it requires no authentication to exploit via the Shop API, which is the public-facing storefront interface. This means any internet-connected attacker can potentially compromise the underlying database. The Admin API is also vulnerable but requires valid credentials, somewhat limiting that attack surface.

All three major database backends supported by Vendure are affected: PostgreSQL, MySQL/MariaDB, and SQLite. This universal impact means there is no safe database configuration that mitigates the vulnerability without applying patches or workarounds.

Root Cause

The root cause is improper input handling in the RequestContextService.getLanguageCode method located in packages/core/src/service/helpers/request-context/request-context.service.ts. The languageCode parameter from incoming HTTP requests is passed directly into SQL query construction without sanitization, parameterization, or validation against an allowlist of valid language codes.

This design flaw violates fundamental secure coding principles for database interaction, where user input should never be trusted and must always be treated as potentially malicious. The absence of prepared statements or parameterized queries at this critical boundary enabled the injection attack.

Attack Vector

The attack is network-based and can be executed remotely without any user interaction. An attacker crafts a malicious HTTP request to the Vendure Shop API, injecting SQL syntax through the languageCode query parameter.

Depending on the underlying database system and its configuration, successful exploitation could allow attackers to:

• Extract sensitive customer data including payment information, personal details, and order history
• Modify or delete database records, potentially corrupting inventory, pricing, or user accounts
• Bypass authentication mechanisms to gain administrative access
• Execute database-specific functions that could lead to further system compromise
• Cause denial of service by running resource-intensive queries or dropping tables

For detailed technical analysis and proof-of-concept information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40887

Indicators of Compromise

• Unusual SQL error messages in application logs, particularly those referencing syntax errors or unexpected query structures
• Anomalous database query patterns, especially those containing SQL keywords (UNION, SELECT, DROP, etc.) in the languageCode parameter
• Unexpected database reads or modifications that don't correlate with normal application behavior
• Evidence of data exfiltration through error-based or time-based blind SQL injection techniques

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection payloads in query parameters, specifically targeting the languageCode field
• Enable database query logging and monitor for queries containing injection patterns or unusual syntax
• Deploy runtime application self-protection (RASP) solutions that can detect and block SQL injection attempts at the application layer
• Review web server access logs for requests with suspicious characters in query strings (single quotes, semicolons, SQL keywords)

Monitoring Recommendations

• Configure alerting for HTTP 500 errors from the Vendure API that may indicate failed injection attempts
• Monitor database server CPU and I/O for anomalies that could suggest time-based blind SQL injection probing
• Implement anomaly detection for database query execution times and volumes
• Enable audit logging on sensitive database tables to track unauthorized access attempts

How to Mitigate CVE-2026-40887

Immediate Actions Required

• Upgrade to Vendure versions 2.3.4, 3.5.7, or 3.6.2 immediately, depending on your current version branch
• If immediate upgrade is not possible, apply the official hotfix that validates languageCode input using RequestContextService.getLanguageCode
• Conduct a thorough security audit of database logs to identify any potential compromise
• Consider rotating database credentials and reviewing access permissions as a precautionary measure

Patch Information

Vendure has released patched versions that address this vulnerability through two mechanisms:

1. Input Validation: The RequestContextService.getLanguageCode method now validates the languageCode input at the boundary, rejecting invalid values and defaulting to the channel's default language.

2. Parameterized Queries: The vulnerable SQL interpolation has been converted to use parameterized queries as defense in depth, ensuring that even if validation is bypassed, injection is not possible.

Patched versions: 2.3.4, 3.5.7, and 3.6.2. Upgrade paths depend on your current version:

• Version 1.7.4 to 2.3.3: Upgrade to 2.3.4
• Version 3.5.x: Upgrade to 3.5.7
• Version 3.6.x: Upgrade to 3.6.2

For complete patch details, see the GitHub Security Advisory.

Workarounds

• Apply the official hotfix to packages/core/src/service/helpers/request-context/request-context.service.ts which replaces the getLanguageCode method with a validated version
• Deploy a WAF or reverse proxy rule to reject requests containing SQL injection patterns in the languageCode parameter
• Restrict network access to the Vendure instance to trusted IP ranges while awaiting the upgrade
• Consider taking the affected application offline if it handles sensitive data and patching cannot be completed quickly

# Upgrade to patched version (example for npm)
npm update @vendure/core@3.6.2
npm update @vendure/admin-ui@3.6.2

# Verify installed version
npm list @vendure/core