npm/@vendure/core CVE-2026-63461: medium 5.3, EPSS 0.44%

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Action: Upgrade @vendure/core to 3.6.5 or later.

npm i @vendure/core@3.6.5

Affected

Fixed versions

Sources

• osv: GHSA-xf65-r35x-wmmv
• https://github.com/vendurehq/vendure/security/advisories/GHSA-xf65-r35x-wmmv
• https://github.com/vendurehq/vendure/commit/6daf5cb8571321eb6c6afa1d8e95a390c060be02
• https://github.com/vendurehq/vendure
• https://github.com/vendurehq/vendure/releases/tag/v3.6.5

CVE-2026-63461 · published 2026-09-17T14:50:02Z · modified 2026-09-17T15:00:05.922876882Z · JSON