Critical 9.1 SQL Injection Threatens Vendure Core Stores

Vendure Core released patches for a critical SQL injection vulnerability (CVSS 9.1) in how the languageCode parameter is handled; an unauthenticated attacker can exploit the Shop API to execute arbitrary SQL across all supported database backends. Multiple release lines are affected and fixed releases plus a suggested input-validation hotfix are provided to mitigate the risk.