Vendure, an open‑source headless commerce platform, contains an unauthenticated SQL injection flaw in its Shop API. The vulnerability arises from a user‑controlled query string parameter that is directly interpolated into a raw SQL expression without parameterization or validation. Because of this, an attacker can craft malicious input that will be executed against the database, enabling the execution of arbitrary SQL commands. This flaw is classified as CWE‑89 and can result in data theft, modification, or loss of database integrity.

The vulnerable component is found in vendurehq's Vendure project. Versions starting at 1.7.4 and up to, but not including, 2.3.4, 3.5.7, and 3.6.2 are impacted. All database backends supported by the platform—PostgreSQL, MySQL/MariaDB, and SQLite—are affected. The Admin API is also exposed to the same issue, though it requires authentication to exploit. Upgraded releases 2.3.4, 3.5.7, and 3.6.2 contain the remediation.

The CVSS score for this vulnerability is 9.1, indicating a critical rating. EPSS is 5%, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is unauthenticated remote access to the Shop API, where the attacker supplies a crafted query string. If authentication is present (Admin API), the attacker needs valid credentials. The remedy is straightforward: update to a patched version or apply the provided hotfix that validates the languageCode value before it reaches the raw SQL layer, thereby blocking injection payloads.