{"api_version":"v1","generated_at":"2026-10-08T14:05:00+00:00","product":{"cve_count":7,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-spree-spree-29cb364e9763","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/spree","name":"spree","next_cursor":null,"observations":[{"affected":"spree: >= 5.4.0, < 5.4.4, >= 5.5.0, < 5.5.4","affected_versions_present":true,"cve_id":"CVE-2026-94462","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-94462","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-09-22T19:20:22.173Z","patch_url":"","primary_source":"","published":"2026-09-22T18:57:03.854Z"},{"affected":"< 5.0.8; >= 5.1.0, < 5.1.10; >= 5.2.0, < 5.2.7; >= 5.3.0, < 5.3.2","affected_versions_present":true,"cve_id":"CVE-2026-25757","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-25757","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-02-09T15:26:28.967Z","patch_url":"https://github.com/spree/spree/commit/3e00be64c128ef4bd4b99731f0c3ab469509cfab","primary_source":"","published":"2026-02-06T22:37:07.542Z"},{"affected":"< 4.10.3; >= 5.0.0, < 5.0.8; >= 5.1.0.beta, < 5.1.10; >= 5.2.0.rc1, < 5.2.7; >= 5.3.0.rc2, < 5.3.2","affected_versions_present":true,"cve_id":"CVE-2026-25758","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-25758","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-02-09T15:26:51.129Z","patch_url":"https://github.com/spree/spree/commit/15619618e43b367617ec8d2d4aafc5e54fa7b734","primary_source":"","published":"2026-02-06T21:29:20.846Z"},{"affected":">= 5.2.0, < 5.2.5; >= 5.1.0, < 5.1.9; >= 5.0.0, < 5.0.7; < 4.10.2","affected_versions_present":true,"cve_id":"CVE-2026-22589","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-22589","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-12T17:32:46.777Z","patch_url":"https://github.com/spree/spree/commit/16067def6de8e0742d55313e83b0fbab6d2fd795","primary_source":"","published":"2026-01-10T03:17:58.494Z"},{"affected":">= 5.2.0, < 5.2.5; >= 5.1.0, < 5.1.9; >= 5.0.0, < 5.0.7; < 4.10.2","affected_versions_present":true,"cve_id":"CVE-2026-22588","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-22588","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-08T21:08:53.049Z","patch_url":"https://github.com/spree/spree/commit/02acabdce2c5f14fd687335b068d901a957a7e72","primary_source":"","published":"2026-01-08T20:53:37.110Z"},{"affected":">= 3.7.0, < 3.7.13; >= 4.0.0, < 4.0.5; >= 4.1.0, < 4.1.12","affected_versions_present":true,"cve_id":"CVE-2020-26223","cve_url":"https://cve.blacktree.nl/cve/CVE-2020-26223","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2024-08-04T15:49:07.219Z","patch_url":"https://github.com/spree/spree/pull/10573","primary_source":"","published":"2020-11-13T17:25:20.000Z"},{"affected":"< 3.7.11; >= 4.0.0, < 4.0.4; >= 4.1.0, < 4.1.11","affected_versions_present":true,"cve_id":"CVE-2020-15269","cve_url":"https://cve.blacktree.nl/cve/CVE-2020-15269","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2024-08-04T13:15:18.944Z","patch_url":"https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847","primary_source":"","published":"2020-10-20T20:15:14.000Z"}],"source_generated_at":"2026-10-08T06:18:52.353Z","vendor":"spree"}}