npm

@vendure/core

6 Total advisories

6 Vulnerabilities

0 Malware

Dependency scanning

Check whether @vendure/core is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

CRITICAL 9.1

npm

CVE-2026-63472

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

Sep 17, 2026

MEDIUM 5.3

npm

CVE-2026-63461

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Sep 17, 2026

CRITICAL 9.1

npm

CVE-2026-40887

@vendure/core has a SQL Injection vulnerability

Apr 14, 2026

UNKNOWN

npm

CVE-2026-25050

Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

Jan 30, 2026

MEDIUM 5.3

npm

GHSA-wm63-7627-ch33

@vendure/core's insecure currencyCode handling allows wrong payment amounts

Nov 17, 2023

UNKNOWN

npm

GHSA-h9wq-xcqx-mqxm

Vendure Cross Site Request Forgery vulnerability impacting all API requests

Jul 11, 2023

Browse more npm advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes