Description
Vendure是一个基于Node.js和TypeScript构建的headless电子商务框架。其Shop API的languageCode参数存在SQL注入漏洞。攻击者可通过构造恶意的languageCode参数，利用EXTRACTVALUE函数进行基于错误的SQL注入，获取数据库敏感信息。
Vendure /shop-api SQL 注入漏洞（CVE-2026-40887）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cve.org/CVERecord?id=CVE-2026-40887
https://www.sentinelone.com/vulnerability-database/cve-2026-40887/
https://www.endorlabs.com/vulnerability/cve-2026-40887
https://github.com/advisories/GHSA-9pp3-53p2-ww9v
https://docs.vendure.io/changelog?focus=v3.6.2
https://avd.aliyun.com/detail?id=AVD-2026-40887
https://vuldb.com/zh/vuln/358581
https://www.tenable.com/cve/CVE-2026-40887
https://advisories.gitlab.com/npm/@vendure/core/CVE-2026-40887/