CVE-2026-25993

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25993", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T17:41:55.858Z", "datePublished": "2026-02-10T17:43:38.998Z", "dateUpdated": "2026-02-10T19:29:56.966Z"}, "containers": {"cna": {"title": "EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch"}, {"name": "http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd", "tags": ["x_refsource_MISC"], "url": "http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd"}], "affected": [{"vendor": "evershopcommerce", "product": "evershop", "versions": [{"version": "< 2.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-10T17:43:38.998Z"}, "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds\npath / request_path values\u2014derived from the url_key stored in the database\u2014into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1."}], "source": {"advisory": "GHSA-3h84-9rhc-j2ch", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T19:29:47.284243Z", "id": "CVE-2026-25993", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:29:56.966Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25993", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T19:29:47.284243Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:29:49.956Z"}}], "cna": {"title": "EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys", "source": {"advisory": "GHSA-3h84-9rhc-j2ch", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "evershopcommerce", "product": "evershop", "versions": [{"status": "affected", "version": "< 2.1.1"}]}], "references": [{"url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch", "name": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd", "name": "http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds\npath / request_path values\u2014derived from the url_key stored in the database\u2014into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-10T17:43:38.998Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25993", "state": "PUBLISHED", "dateUpdated": "2026-02-10T19:29:56.966Z", "dateReserved": "2026-02-09T17:41:55.858Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-10T17:43:38.998Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "evershop", "vendor": "evershopcommerce", "versions": [{"status": "affected", "version": "< 2.1.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "227349FD-25AD-4D12-AD7B-F50210FF385D", "versionEndIncluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds\npath / request_path values\u2014derived from the url_key stored in the database\u2014into SQL statements via string concatenation and passes them to execute(). As a result, if a malicious string is stored in url_key , subsequent event processing modifies and executes the SQL statement, leading to a second-order SQL injection. Patched from v2.1.1."}, {"lang": "es", "value": "EverShop es una plataforma de comercio electr\u00f3nico con prioridad en TypeScript. Durante el manejo de eventos de actualizaci\u00f3n y eliminaci\u00f3n de categor\u00edas, la aplicaci\u00f3n incrusta valores de ruta / ruta de solicitud \u2014derivados de la url_key almacenada en la base de datos\u2014 en sentencias SQL mediante concatenaci\u00f3n de cadenas y los pasa a execute(). Como resultado, si una cadena maliciosa se almacena en url_key, el procesamiento de eventos posterior modifica y ejecuta la sentencia SQL, lo que lleva a una inyecci\u00f3n SQL de segundo orden. Parcheado a partir de la v2.1.1."}], "id": "CVE-2026-25993", "lastModified": "2026-06-17T10:25:33.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25993", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T19:29:47.284243Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:38.957", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "http://github.com/evershopcommerce/evershop/commit/5c5bdf2c1ad5d16ae68e9e48b494563953b6d1cd"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-3h84-9rhc-j2ch"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.1)"}}], "product": "evershop", "vendor": "evershop"}], "analysis": {"en": {"generated_at": "2026-04-17T20:43:18.192250+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch v2.1.1 or later to replace string concatenation with parameterized queries.", "Limit write permissions on the url_key column to ensure only trusted administrative users can modify it.", "Review the codebase for other instances of dynamic SQL construction and refactor them to use safe query practices."], "summary": {"action": "Apply Patch", "impact": "Second\u2011Order SQL Injection leading to data compromise"}, "threat_synthesis": {"affected_systems": "The affected product is EverShop evershop. Versions prior to the 2.1.1 release are vulnerable; the fix is available in v2.1.1 and later releases.", "description_and_impact": "EverShop concatenates url_key values\u2014derived from category URL keys\u2014directly into SQL statements during category update and deletion event handling. This design flaw allows a second\u2011order SQL injection that can compromise data confidentiality and integrity by executing arbitrary SQL when malicious content is stored in url_key. The vulnerability carries an 9.3 CVSS score, indicating a high\u2011severity impact if exploited.", "risk_and_exploitability": "The EPSS score is below 1\u2009%, and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation probability in the wild. The likely attack vector requires an attacker to inject malicious characters into the url_key field, which typically necessitates privileged access to modify category data. If achieved, the attacker could achieve unauthorized data export or alteration."}}}}, "created": "2026-02-11T21:52:19.158499+00:00", "updated": "2026-04-17T20:45:25.773571+00:00", "vendors": ["evershop", "evershop$PRODUCT$evershop"]}