Urban rail transit (URT) systems are critical to modern public transportation services. Unfortunately, disruptions in URT systems can lead to dysfunction and threaten sustainable development. This study analyses URT network sustainability from a vulnerability perspective. Two network attack scenarios, including random attacks and intentional attacks, are designed to assess different kinds of disruptions to URT networks. Under random attacks, nodes are randomly removed from the network. In contrast, under intentional attacks, key nodes are identified and removed based on topological metrics and passenger flow volume. Then, URT network vulnerability is evaluated by quantifying the changes in network efficiency and structural integrity under the network attacks from a spatio-temporal point of view. The real-world case of the Shanghai URT system from 1993 to 2020 is used to illustrate the vulnerability in the evolution of the URT system. The results indicate that the URT network is increasingly fault-tolerant and structurally robust over time. The URT network is more vulnerable to intentional attacks than to random failures. Additionally, there are significant spatial differences in the vulnerability of Shanghai URT network. Stations in the central activity zone (CAZ) are more fault-tolerant and robust than stations located outside of the CAZ. Furthermore, stations with large centrality and greater passenger flow volumes and lines with many key nodes and greater passenger flow volumes, are vulnerable to disruptions in the URT networks. This study provides a new index to comprehensively quantify node centrality; it also fills a research gap by analysing the vulnerability of URT networks based on both longitudinal and spatial patterns. Finally, this paper highlights significant practical implications for the sustainable development of URT networks, as well as the sustainable development of public transportation services.