https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:49:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71282 <p>ChirpStack&#39;s SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust&#39;s format! macro , while only the tag VALUE is safely parameter-bound via Diesel&#39;s .bind.</p> <p>ChirpStack&#39;s SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust&#39;s format! macro , while only the tag VALUE is safely parameter-bound via Diesel&#39;s .bind.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71282 https://vulnerability.circl.lu/vuln/ghsa-9g5q-g36m-7qqq <p>ChirpStack&#39;s SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust&#39;s format!() macro (`dsl::sql::&lt;Bool&gt;(&amp;format!(&#34;device.tags-&gt;&gt;&#39;{}&#39; =&#34;, k)).bind::&lt;Text, _&gt;(v)`), while only the tag VALUE is safely parameter-bound via Diesel&#39;s .bind(). An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use; the PostgreSQL backend is unaffected as it uses Diesel&#39;s native JSONB containment operator instead of raw SQL string formatting.</p> <p>ChirpStack&#39;s SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust&#39;s format!() macro (`dsl::sql::&lt;Bool&gt;(&amp;format!(&#34;device.tags-&gt;&gt;&#39;{}&#39; =&#34;, k)).bind::&lt;Text, _&gt;(v)`), while only the tag VALUE is safely parameter-bound via Diesel&#39;s .bind(). An authenticated user with device-list access can inject SQL via a crafted tag key when the SQLite backend (chirpstack-sqlite package) is in use; the PostgreSQL backend is unaffected as it uses Diesel&#39;s native JSONB containment operator instead of raw SQL string formatting.</p> https://vulnerability.circl.lu/vuln/ghsa-9g5q-g36m-7qqq