Vendure
Monthly
Stored cross-site scripting in the Vendure Admin Dashboard (@vendure/dashboard prior to 3.6.5) lets an authenticated, low-privilege administrator store markup in an entity description that executes in a higher-privilege administrator's browser when that administrator opens the affected Products, Collections, Promotions, Payment Methods or Shipping Methods list view, enabling session compromise and cross-privilege or cross-channel administrative actions. The root cause is CWE-79: RichTextDescriptionCell 'strips' HTML by assigning the attacker-controlled description to a live element's innerHTML and only afterwards reading textContent, so active markup such as <img src=x onerror=...> fires during the assignment. The CVSS 3.1 base score is 8.7 (High) on vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - network reachable and low complexity, but requiring an authenticated low-privilege admin account (PR:L) plus a victim admin's interaction (UI:R) when a poisoned row is viewed. The vendor advisory includes a working proof-of-concept payload, i.e. publicly available exploit code exists, but the supplied intelligence contains no CISA KEV entry or other indication of confirmed active exploitation.
Account takeover in Vendure (@vendure/core) prior to 3.7.0 allows an attacker to bind their own external OAuth/social identity to a victim's pre-existing customer account by presenting the victim's email address through a custom AuthenticationStrategy that does not enforce provider-verified email ownership. A successful link exposes the victim's orders, addresses and personal information and permits account changes or order placement as the victim, and the flaw is remotely reachable without authentication per the reported vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1 vendor score). Real-world exposure is materially narrower than that score suggests: only non-default deployments that configure at least one external strategy forwarding an unverified email are affected, and a pre-existing account with the same address must already exist; native email/password-only stores and strategies that always require provider-verified emails are unaffected. No public exploit code was identified at time of analysis and there is no CISA KEV listing indicating confirmed active exploitation; the issue is fixed in 3.7.0.
Unauthenticated denial of service in Vendure (open-source headless commerce platform) versions up to and including 3.6.4 lets a remote attacker freeze the Node.js event loop by supplying a catastrophically backtracking regular expression to the publicly reachable Shop GraphQL products query through StringOperators.regex, rendering both the storefront and admin API unavailable; repeated requests can sustain the outage. The flaw is only reachable on instances running the better-sqlite3 or sqljs SQLite drivers, which register a synchronous JavaScript REGEXP user-defined function on the event loop, whereas PostgreSQL and MySQL/MariaDB deployments push the pattern to the database engine and are unaffected. CVSS 3.1 rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis; vendor-released patch: 3.6.5.
Unauthenticated attackers can retrieve hidden catalog entities from Vendure's publicly accessible Shop API by setting the filterOperator argument to OR, which causes the mandatory visibility guard to be OR-combined with the caller's own filters instead of AND-combined. The flaw affects the npm package @vendure/core in all versions from 1.0.0 up to (but not including) 3.6.5 and exposes disabled products and private collections or facets through the products, collections, and facets list queries. CVSS 3.1 is 5.3 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), consistent with read-only information disclosure; no public exploit identified at time of analysis, although the upstream fix commit and its regression tests are publicly visible.
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.
Vendure versions up to 3.5.3 contains a vulnerability that allows attackers to enumerate valid usernames (email addresses) (CVSS 5.3).
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stored cross-site scripting in the Vendure Admin Dashboard (@vendure/dashboard prior to 3.6.5) lets an authenticated, low-privilege administrator store markup in an entity description that executes in a higher-privilege administrator's browser when that administrator opens the affected Products, Collections, Promotions, Payment Methods or Shipping Methods list view, enabling session compromise and cross-privilege or cross-channel administrative actions. The root cause is CWE-79: RichTextDescriptionCell 'strips' HTML by assigning the attacker-controlled description to a live element's innerHTML and only afterwards reading textContent, so active markup such as <img src=x onerror=...> fires during the assignment. The CVSS 3.1 base score is 8.7 (High) on vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - network reachable and low complexity, but requiring an authenticated low-privilege admin account (PR:L) plus a victim admin's interaction (UI:R) when a poisoned row is viewed. The vendor advisory includes a working proof-of-concept payload, i.e. publicly available exploit code exists, but the supplied intelligence contains no CISA KEV entry or other indication of confirmed active exploitation.
Account takeover in Vendure (@vendure/core) prior to 3.7.0 allows an attacker to bind their own external OAuth/social identity to a victim's pre-existing customer account by presenting the victim's email address through a custom AuthenticationStrategy that does not enforce provider-verified email ownership. A successful link exposes the victim's orders, addresses and personal information and permits account changes or order placement as the victim, and the flaw is remotely reachable without authentication per the reported vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1 vendor score). Real-world exposure is materially narrower than that score suggests: only non-default deployments that configure at least one external strategy forwarding an unverified email are affected, and a pre-existing account with the same address must already exist; native email/password-only stores and strategies that always require provider-verified emails are unaffected. No public exploit code was identified at time of analysis and there is no CISA KEV listing indicating confirmed active exploitation; the issue is fixed in 3.7.0.
Unauthenticated denial of service in Vendure (open-source headless commerce platform) versions up to and including 3.6.4 lets a remote attacker freeze the Node.js event loop by supplying a catastrophically backtracking regular expression to the publicly reachable Shop GraphQL products query through StringOperators.regex, rendering both the storefront and admin API unavailable; repeated requests can sustain the outage. The flaw is only reachable on instances running the better-sqlite3 or sqljs SQLite drivers, which register a synchronous JavaScript REGEXP user-defined function on the event loop, whereas PostgreSQL and MySQL/MariaDB deployments push the pattern to the database engine and are unaffected. CVSS 3.1 rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis; vendor-released patch: 3.6.5.
Unauthenticated attackers can retrieve hidden catalog entities from Vendure's publicly accessible Shop API by setting the filterOperator argument to OR, which causes the mandatory visibility guard to be OR-combined with the caller's own filters instead of AND-combined. The flaw affects the npm package @vendure/core in all versions from 1.0.0 up to (but not including) 3.6.5 and exposes disabled products and private collections or facets through the products, collections, and facets list queries. CVSS 3.1 is 5.3 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), consistent with read-only information disclosure; no public exploit identified at time of analysis, although the upstream fix commit and its regression tests are publicly visible.
Cross-channel authorization bypass in Vendure through 3.7.1 allows a low-privileged, channel-scoped administrator to overwrite StockLocation inventory records and Asset catalog entries belonging to other tenants by submitting global GraphQL entity IDs that their channel does not own. The flaw is in the update methods of stock-location.service.ts and asset.service.ts, which omit the required channelId filter during entity lookup, permitting cross-tenant data corruption without triggering any authorization error. A public proof-of-concept exists via GitHub issue #5003, and an upstream fix is available in commit f67ef5f via PR #5017, though a tagged release version incorporating the fix has not been independently confirmed.
Vendure versions up to 3.5.3 contains a vulnerability that allows attackers to enumerate valid usernames (email addresses) (CVSS 5.3).
In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog permission can upload a SVG file that contains malicious JavaScript into the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.