SQL injection in Vendure Shop API (@vendure/core) (CVE-2026-40887)

An unauthenticated SQL injection vulnerability exists in the Vendure Shop API where a user-controlled `languageCode` query string parameter is interpolated directly into a raw SQL expression without parameterization or runtime validation. An unauthenticated attacker can exploit this on any default Vendure installation to execute arbitrary SQL against all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin API is also affected but requires authentication to exploit. Public POC available. Affected versions: - @vendure/core >= 1.7.4, < 2.3.4 - @vendure/core >= 3.0.0, < 3.5.7 - @vendure/core >= 3.6.0, < 3.6.2 We recommend updating to: @vendure/core 2.3.4, @vendure/core 3.5.7, @vendure/core 3.6.2. CVSS 9.1 · our assessment: act_now Reference: https://github.com/vendurehq/vendure/security/advisories/GHSA-9pp3-53p2-ww9v Details: https://vuln.today/cve/CVE-2026-40887