Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @vendure/core | npm | >= 1.0.0, < 3.6.5 | 3.6.5 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2026-63461) in Vendure's Shop API allowed for the exposure of non-public entities (disabled products, private collections, private facets) when list queries (products, collections, facets) were made with filterOperator: OR. The core issue was that the mandatory security filters (guards like Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false) were combined with the caller-supplied filter using the caller-controlled filterOperator. When filterOperator was set to OR, the guard was effectively bypassed because the OR condition could be satisfied by the malicious user's filter, even if the guard condition was false for the targeted private entity. The patch addresses this by introducing a new method, enforceGuardFilter, which ensures that the mandatory guard filter is always AND-combined with the user's filter, regardless of the filterOperator specified by the user. This prevents the OR operator from negating the security guard. The vulnerable functions are the products, collections, and facets methods within the ShopProductsResolver class, as these were directly responsible for constructing the query options in a way that allowed the guard to be bypassed.
ShopProductsResolver.productspackages/core/src/api/resolvers/shop/shop-products.resolver.ts
ShopProductsResolver.collectionspackages/core/src/api/resolvers/shop/shop-products.resolver.ts
ShopProductsResolver.facetspackages/core/src/api/resolvers/shop/shop-products.resolver.ts