Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63460— Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Quick assessment

Affected
vendurehq vendure
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vendure 是一个开源的无头（headless）电子商务平台。在 3.6.5 版本之前，其公开的 Shop GraphQL API 允许未经认证的调用者通过 传入一个具有灾难性回溯（catastrophic backtracking）特征的字符串。 会将原始正则表达式模式直接传递给 中注册的 REGEXP 实现，而 和 会在 Node.js 事件循环中同步执行该正则表达式。由于 是公开可访问的，攻击者可以使用一个包含嵌套量词的正则表达式模式来阻塞请求处理，导致商店前端和管理 API 无法访问；同时，通过持续发送

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63460

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
Source: CVE Program / CVE List V5
Vulnerability Description
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vendurehq vendure < 3.6.5 -

II. Public POCs for CVE-2026-63460

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63460

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63460 (1)

Vendor Advisories for CVE-2026-63460 (1)

Vendor Pages for CVE-2026-63460 (1)

Same Patch Batch · vendurehq · 2026-09-17 · 4 CVEs total

CVE-2026-63472 9.1 CRITICAL Vendure: External-authentication account takeover: external login linked to a pre-existing
CVE-2026-63459 8.7 HIGH Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity
CVE-2026-63461 5.3 MEDIUM Vendure: Shop API list queries can return non-public entities when filterOperator is OR

IV. Related Vulnerabilities

Same product: vendure
Same vendor: vendurehq
Same weakness: CWE-1333

V. Comments for CVE-2026-63460

No comments yet

Leave a comment