coreshop/core-shop

CoreShop - Pimcore eCommerce

Latest 2026.2.2

Packagist

76%

Total Score

Maintainer Stability

100

Dependencies

Maturity

100

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package has 32 runtime dependencies, reflecting substantial complexity for a full eCommerce platform. This increases integration and update surface but is consistent with the package's broad functionality rather than evidence of abandonment.

Workflow audit

All 26 workflows were analyzed, but every one of 78 action references is unpinned; the audit also found a high-confidence unpinned image, high-confidence inherited secrets, and nine untrusted checkouts in pull_request_target workflows. Low-confidence cache findings are hygiene concerns, while the untrusted paths make the broader CI configuration materially risky.

Vulnerabilities

Title	Versions	Severity
CVE-2026-41249 coreshop/core-shop is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 5.0.0 - 5.0.0.	5.0.0 - 5.0.0	High
AIKIDO-2026-10276 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. coreshop/core-shop is vulnerable to Generation of Error Message Containing Sensitive Information in versions 2.0.0 - 4.1.9.	2.0.0 - 4.1.9	Low
CVE-2026-23959 coreshop/core-shop is vulnerable to SQL Injection: Hibernate in versions 0.0.0 - 4.1.9.	0.0.0 - 4.1.9	Medium
CVE-2026-22242 coreshop/core-shop is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 4.1.7.	0.0.0 - 4.1.7	Medium

Package versions

Maintainers

CoreShop Team

Dominik Pfaffenbauer

Direct Dependencies

Dependency	Last Release	Score
payum/payum Version 1.7.x-dev	—	—
doctrine/orm Version ^3.0,<3.6.8	—	—
symfony/form Version ^6.4.14 \|\| ^7.2	—	—
symfony/intl Version ^6.4.14 \|\| ^7.2	—	—
doctrine/dbal Version ^4.2	—	—