@vendure/core

A modern, headless ecommerce framework
Licenses: GPL-3.0 | MIT

License

GPL-3.0>=3.0.0-next.0;
MIT>=0.1.0-alpha.1 <3.0.0-next.0;

Direct Vulnerabilities

Known vulnerabilities in the @vendure/core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free
VulnerabilityVulnerable Version
  • H
SQL Injection

>=1.7.4 <2.3.4>=3.0.0-next.0 <3.5.7>=3.6.0 <3.6.2
  • M
Information Exposure

<3.5.3
  • M
Improper Input Validation

<2.1.3
  • M
Cross-site Request Forgery (CSRF)

<2.0.3
  • M
Cross-site Scripting (XSS)

<1.5.2

Package versions

801 VERSIONS IN TOTAL See all versions
versionpublisheddirect vulnerabilities
3.9.0-minor-20261024022124 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261023021923 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261022082822 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261020022020 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261017022017 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261016022016 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261015022015 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261014021914 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.9.0-minor-20261013023413 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.8.2-master-20261024021224 Oct, 2026
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L