solidus_core

🛒 Solidus, the open-source eCommerce framework for industry trailblazers.

View on Rubygems

View on Github

Activity

Latest release: 5d ago
Total releases: 202
Cadence: ~5 days
Last 12 months: 5

Reach

Downloads: 3.6M
Stars: 5.3k

Details

License: BSD-3-Clause
First release: Jun 29, 2015

Releases

Version	Released
`4.6.3` patch	Sep 09, 2026
`4.7.1` patch	Sep 09, 2026
`4.7.0` minor	Apr 15, 2026
`4.6.2` patch	Nov 27, 2025
`4.6.1` patch	Oct 21, 2025
`4.6.0` minor	Sep 09, 2025
`4.5.1` patch	Mar 06, 2025
`4.5.0` minor	Feb 20, 2025
`4.3.6` patch	Feb 19, 2025
`4.2.5` patch	Feb 19, 2025
`4.1.6` patch	Feb 12, 2025
`4.4.2` patch	Dec 09, 2024
`4.4.1` patch	Nov 18, 2024
`4.4.0` minor	Nov 12, 2024
`4.3.5` patch	May 24, 2024
`4.1.5` patch	Apr 05, 2024
`4.2.4` patch	Apr 05, 2024
`4.3.4` patch	Apr 05, 2024
`4.3.3` patch	Mar 11, 2024
`4.3.2` patch	Jan 22, 2024
`4.1.4` patch	Jan 05, 2024
`4.3.1` patch	Jan 05, 2024
`4.3.0` minor	Dec 27, 2023
`4.2.3` patch	Nov 02, 2023
`4.0.4` patch	Nov 02, 2023
`4.1.3` patch	Nov 02, 2023
`3.4.6` patch	Nov 02, 2023
`4.0.3` patch	Nov 01, 2023
`4.1.2` patch	Nov 01, 2023
`3.4.5` patch	Nov 01, 2023
`4.2.2` patch	Nov 01, 2023
`4.2.1` patch	Oct 04, 2023
`4.2.0` minor	Sep 29, 2023
`3.4.4` patch	Aug 14, 2023
`4.1.1` patch	Aug 14, 2023
`3.2.9` patch	Aug 14, 2023
`4.0.2` patch	Aug 14, 2023
`3.3.4` patch	Aug 14, 2023
`3.3.3` patch	Jul 03, 2023
`3.4.3` patch	Jul 03, 2023
`3.2.8` patch	Jul 03, 2023
`4.0.1` patch	Jun 30, 2023
`4.1.0` minor	Jun 29, 2023
`4.0.0` major	May 08, 2023
`3.4.2` patch	May 04, 2023
`3.3.2` patch	Apr 27, 2023
`3.4.1` patch	Apr 27, 2023
`3.2.7` patch	Apr 27, 2023
`3.4.0` minor	Apr 21, 2023
`3.1.9` patch	Feb 07, 2023

1–50 of 202

Repository

solidusio/solidus

Forks: 1.4k
Open issues: 56
Language: Ruby
: 6.1/ 10

solidus
ruby
rails
storefront
ecommerce
ecommerce-platform

Dependencies (27)

Depends on

4.6.3

Used by

123

Supply-chain exposure

123 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2021-43805 GHSA-qxmr-qxh6-2cc9 Dec 07, 2021

ReDos vulnerability on guest checkout email validation

7.5 / 10
High
Network Low None None Unchanged None None High

Impact

Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like a.a..

Before the patch, it can be reproduced in the console like this:

irb(main)> Spree::EmailValidator::EMAIL_REGEXP.match "a@a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.a.@" processing time: 54.293660s => nil

To reproduce in the browser, fill in the "Customer Email" field with that fake email address during a guest checkout. Before that, you should open the browser dev tools and change the type attribute for that field from email to text. After entering a fake address and pressing the "Save & Continue" button, the browser will take a long term to perform the request before showing an error message for the invalid address. Eventually, making the email string even longer could lead to the exhaustion of server resources.

Patches

Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression.

There's an improbable chance that some orders in your system end up having associated an email address that is no longer valid. We've added a task to check precisely that:

bin/rails solidus:check_orders_with_invalid_email

The above will print information for every affected order if any.

Workarounds

If a prompt upgrade is not an option, please, add the following to config/application.rb:

config.after_initialize do Spree::EmailValidator.send(:remove_const, :EMAIL_REGEXP) Spree::EmailValidator::EMAIL_REGEXP = URI::MailTo::EMAIL_REGEXP end

References

https://en.wikipedia.org/wiki/ReDoS

https://snyk.io/blog/redos-and-catastrophic-backtracking/

For more information

If you have any questions or comments about this advisory:

Open an issue or a discussion in Solidus.

Email us at security@solidus.io

Contact the core team on Slack

Affected versions

1.0.01.0.0.pre1.0.0.pre21.0.0.pre31.0.0.rc11.0.0.rc21.0.11.0.21.0.31.0.41.0.51.0.6

+ 114 more Show less

1.0.71.1.01.1.0.beta11.1.0.pre11.1.0.pre21.1.11.1.21.1.31.1.41.2.01.2.0.beta11.2.0.rc11.2.0.rc21.2.11.2.21.2.31.3.01.3.0.beta11.3.0.rc11.3.0.rc21.3.11.3.21.4.01.4.0.beta11.4.0.rc11.4.11.4.22.0.02.0.0.beta12.0.0.rc12.0.12.0.22.0.32.1.02.1.0.beta12.1.0.rc12.1.12.10.02.10.0.beta12.10.12.10.22.10.32.10.52.11.02.11.12.11.102.11.112.11.122.11.22.11.32.11.42.11.52.11.62.11.72.11.82.11.92.2.02.2.0.beta12.2.0.rc12.2.12.2.22.3.02.3.0.beta12.3.0.rc12.3.0.rc22.3.0.rc32.3.12.4.02.4.0.beta12.4.0.rc12.4.12.4.22.5.02.5.0.beta12.5.0.beta22.5.0.rc12.5.12.5.22.6.02.6.0.rc12.6.12.6.22.6.32.6.42.6.52.6.62.7.02.7.12.7.22.7.32.7.42.8.02.8.12.8.22.8.32.8.42.8.52.8.62.9.02.9.0.rc.12.9.12.9.22.9.32.9.42.9.52.9.63.0.03.0.13.0.23.0.33.1.03.1.13.1.23.1.3

Fixed in

2.11.133.0.43.1.4

References

https://github.com/solidusio/solidus/security/advisories/GHSA-qxmr-qxh6-2cc9
https://nvd.nist.gov/vuln/detail/CVE-2021-43805
https://github.com/solidusio/solidus/commit/6be174c955fad84017ca67589c676526bc5ade71
https://github.com/solidusio/solidus/commit/9867153e01e3c3b898cdbcedd7b43375ea922401
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/solidus_core/CVE-2021-43805.yml
https://github.com/solidusio/solidus

Updated Jul 08, 2026 · Source: OSV.dev
GHSA-5629-8855-gf4g Nov 18, 2021

Authentication Bypass by CSRF Weakness

9.3 / 10
Critical
Network Low None Required Changed High High None

Impact

The actual vulnerability has been discovered on solidus_auth_devise. See GHSA-xm34-v85h-9pg2 for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidus_auth_devise. For this reason, it has been marked as low impact on this end.

Patches

For extra security, update solidus_core to versions 3.1.3, 3.0.3 or 2.11.12.

Workarounds

Look at the workarounds described at GHSA-xm34-v85h-9pg2.

References

GHSA-xm34-v85h-9pg2.

For more information

If you have any questions or comments about this advisory:

Open an issue in solidus_auth_devise or a discussion in solidus

Email us at security@solidus.io

Contact the core team on Slack

Affected versions

1.0.01.0.0.pre1.0.0.pre21.0.0.pre31.0.0.rc11.0.0.rc21.0.11.0.21.0.31.0.41.0.51.0.6

+ 111 more Show less

1.0.71.1.01.1.0.beta11.1.0.pre11.1.0.pre21.1.11.1.21.1.31.1.41.2.01.2.0.beta11.2.0.rc11.2.0.rc21.2.11.2.21.2.31.3.01.3.0.beta11.3.0.rc11.3.0.rc21.3.11.3.21.4.01.4.0.beta11.4.0.rc11.4.11.4.22.0.02.0.0.beta12.0.0.rc12.0.12.0.22.0.32.1.02.1.0.beta12.1.0.rc12.1.12.10.02.10.0.beta12.10.12.10.22.10.32.10.52.11.02.11.12.11.102.11.112.11.22.11.32.11.42.11.52.11.62.11.72.11.82.11.92.2.02.2.0.beta12.2.0.rc12.2.12.2.22.3.02.3.0.beta12.3.0.rc12.3.0.rc22.3.0.rc32.3.12.4.02.4.0.beta12.4.0.rc12.4.12.4.22.5.02.5.0.beta12.5.0.beta22.5.0.rc12.5.12.5.22.6.02.6.0.rc12.6.12.6.22.6.32.6.42.6.52.6.62.7.02.7.12.7.22.7.32.7.42.8.02.8.12.8.22.8.32.8.42.8.52.8.62.9.02.9.0.rc.12.9.12.9.22.9.32.9.42.9.52.9.63.0.03.0.13.0.23.1.03.1.13.1.2

Fixed in

2.11.123.0.33.1.3

References

https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
https://github.com/solidusio/solidus

Updated Dec 02, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 3
minor 26
patch 136
pre 36

202 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More