Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
3.x.x	✅
2.x.x	✅
1.x.x	❌
< 1.0	❌

Reporting a Vulnerability

To report a security vulnerability, email contact@vendure.io.

Local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
GHSA-r9mq-3c9r-fmjq published Oct 15, 2024 by michaelbromley

Critical
Insecure currencyCode handling allows wrong payment amounts
GHSA-wm63-7627-ch33 published Nov 17, 2023 by michaelbromley

Moderate
Authenticated XSS in admin-ui description
GHSA-gm68-572p-q28r published Jul 4, 2023 by michaelbromley

Moderate
CSRF impacting all API requests
GHSA-h9wq-xcqx-mqxm published Jul 11, 2023 by michaelbromley

Low

Learn more about advisories related to vendure-ecommerce/vendure in the GitHub Advisory Database