Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
1.x.x	✅
< 1.0	❌

Reporting a Vulnerability

To report a security vulnarability, email contact@vendure.io.

Insecure currencyCode handling allows wrong payment amounts
GHSA-wm63-7627-ch33 published Nov 17, 2023 by michaelbromley

Moderate
Authenticated XSS in admin-ui description
GHSA-gm68-572p-q28r published Jul 4, 2023 by michaelbromley

Moderate
CSRF impacting all API requests
GHSA-h9wq-xcqx-mqxm published Jul 11, 2023 by michaelbromley

Low

Learn more about advisories related to vendure-ecommerce/vendure in the GitHub Advisory Database