GHSA-9pp3-53p2-ww9v: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in @vendure/core

An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite).

The Admin API is also affected, though exploitation there requires authentication.