Read the docs
TI-2020-09551 Aliases CVE-2020-11883GHSA-9wxj-37p8-49ff

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used…

Priority MEDIUM 40CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

Why it matters now

EPSS 0.1515 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed storefront-api (npm): 1.0.0-rc3vue-storefront-api (npm): 1.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—storefront-api (npm)before 1.0.0-rc31.0.0-rc3Patch availableGHSA-9wxj-37p8-49ff
—vue-storefront-api (npm)before 1.12.01.12.0Patch availableGHSA-9wxj-37p8-49ff
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • storefront-api (npm) Vendor— Affected before 1.0.0-rc3 Fixed in 1.0.0-rc3 Patch available GHSA-9wxj-37p8-49ff
  • vue-storefront-api (npm) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-9wxj-37p8-49ff

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:divante:storefront-api:1.0:rc1:*:*:*:*:*:*1.0 rc1VulnerableDivante
cpe:2.3:a:divante:vue-storefront-api:*:*:*:*:*:*:*:*up to 1.11.1VulnerableDivante
  • cpe:2.3:a:divante:storefront-api:1.0:rc1:*:*:*:*:*:* Versions 1.0 rc1 Vulnerable ·Divante
  • cpe:2.3:a:divante:vue-storefront-api:*:*:*:*:*:*:*:* Versions up to 1.11.1 Vulnerable ·Divante

Remediation

  • Fix · GHSA-9wxj-37p8-49ff storefront-api (npm) Fixed in 1.0.0-rc3 Advisory →
  • Fix · GHSA-9wxj-37p8-49ff vue-storefront-api (npm) Fixed in 1.12.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11883
  2. 2026-10-03 Alias added: GHSA-9wxj-37p8-49ff

References

Exploit 1

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences