Vendure Core vulnerabilities

CVE-2026-40887 [CRITICAL] CWE-89 @vendure/core has a SQL Injection vulnerability @vendure/core has a SQL Injection vulnerability ## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite

CVE-2026-25050 [LOW] CWE-202 Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy ### Summary The `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). ### Details In `packages/core/src/config/auth/native-authentication-strategy.ts`, the authenticate me