PatchTheCVEspree vulnerabilities and fixes
Recent CVEs affecting spree, with upgrade or downgrade steps. 5 tracked.
spree has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-02-06. Highest priority: CVE-2011-10019 (score 71/100).
- CVE-2011-10019 CRITICAL 9.8 UPGRADE Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functio
- CVE-2026-25758 HIGH 7.5 UPGRADE Spree is an open source e-commerce solution built with Ruby on Rails
- CVE-2026-25757 MEDIUM 5.3 UPGRADE Spree is an open source e-commerce solution built with Ruby on Rails
- CVE-2026-22588 MEDIUM 6.5 UPGRADE Spree is an open source e-commerce solution built with Ruby on Rails
- CVE-2011-10026 CRITICAL 9.8 UPGRADE Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search fu
FAQ
How do I fix spree vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spree being exploited right now?
None of the tracked spree CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spree CVE should I patch first?
CVE-2011-10019 currently ranks highest (71/100): Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functio.