What is the CVSS score of CVE-2026-25993?

CVE-2026-25993 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Evershop are affected by CVE-2026-25993?

A critical SQL injection vulnerability in EverShop's category management functions could allow attackers to execute arbitrary database commands, potentially compromising customer data, payment…. A patch is available.

How to fix or mitigate CVE-2026-25993?

Within 24 hours: Inventory all EverShop instances and assess exposure; disable category update/deletion features if possible. Within 7 days: Apply the available vendor patch to all affected systems and validate successful deployment. Within 30 days: Conduct security testing to confirm patch effectiveness and review access logs for signs of exploitation.

Evershop CVE-2026-25993

CRITICAL

SQL Injection (CWE-89)

2026-02-10 security-advisories@github.com

SQLi Evershop

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

Patch released

Feb 23, 2026 - 18:03 nvd

Patch available

CVE Published

Feb 10, 2026 - 18:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values-derived from the url_key stored in the database-into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1.

AnalysisAI

SQL injection in EverShop e-commerce platform during category update/deletion event handling. Path/request_path values injected unsanitized into SQL. Patch available.