Vendure @vendure/core npm Package Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- @vendure/core (npm)
- Affected versions
- < 3.5.3 or >= 3.0.0, < 3.5.7 or >= 3.6.0, < 3.6.2 or >= 1.7.4, < 2.3.4 or < 2.0.3 or < 2.1.3
- Patched version
- 3.7.0
An early warning has been issued for a vulnerability in the @vendure/core npm package that could lead to external-authentication account takeovers. Users of affected versions should take immediate action.
What happened
The @vendure/core npm package is reportedly affected by an external-authentication account takeover vulnerability. This issue allows external logins to be linked to pre-existing accounts by email without requiring verification, which can lead to unauthorized account access. The vulnerability is under investigation and has not been exploited in the wild as of the latest reports.
Affected versions include those less than 3.5.3 or greater than or equal to 3.0.0 but less than 3.5.7 or greater than or equal to 3.6.0 but less than 3.6.2 or greater than or equal to 1.7.4 but less than 2.3.4 or less than 2.0.3 or less than 2.1.3. The recommended action is to upgrade to version 3.7.0 to ensure external logins are only linked to pre-existing accounts when the email is verified.
What to do about it
- Identify the version of @vendure/core currently in use in your environment.
- If your version is affected, upgrade to @vendure/core version 3.7.0 immediately.
- Verify that external logins are now only linked to pre-existing accounts when the email is verified.
- Monitor the primary sources for any updates or additional information regarding this vulnerability.
How 0Day would have caught this
@vendure/core is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of @vendure/core less than 3.5.3 or greater than or equal to 3.0.0 but less than 3.5.7 or greater than or equal to 3.6.0 but less than 3.6.2 or greater than or equal to 1.7.4 but less than 2.3.4 or less than 2.0.3 or less than 2.1.3.
What should I do right now?
Immediately upgrade to @vendure/core version 3.7.0 to mitigate the vulnerability.
Has this been exploited in the wild?
No, there are no reports of this vulnerability being exploited in the wild as of the latest information.
Where can I find more information?
Consult the primary sources provided for the most up-to-date information on this vulnerability.