Common Weakness Enumeration

CWE-943

Allowed-with-Review

Improper Neutralization of Special Elements in Data Query Logic

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

231 vulnerabilities reference this CWE, most recent first.

GHSA-FQ69-3PM5-2H3G

Vulnerability from github – Published: 2026-09-26 15:31 – Updated: 2026-09-26 15:31
VLAI
Details

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-100631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-26T14:16:44Z",
    "severity": "HIGH"
  },
  "details": "Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup \u2014 which runs with elevated privileges before class-level permissions are evaluated \u2014 to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.",
  "id": "GHSA-fq69-3pm5-2h3g",
  "modified": "2026-09-26T15:31:16Z",
  "published": "2026-09-26T15:31:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-cc6h-c8m4-hgrx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100631"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/parse-server-9.0.0-unauthenticated-installation-deletion-via-operator-injection"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FR2J-M9J7-53R7

Vulnerability from github – Published: 2026-10-01 12:31 – Updated: 2026-10-01 12:31
VLAI
Details

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.

Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-103258"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-01T11:17:20Z",
    "severity": "MODERATE"
  },
  "details": "n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries.",
  "id": "GHSA-fr2j-m9j7-53r7",
  "modified": "2026-10-01T12:31:16Z",
  "published": "2026-10-01T12:31:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-5pg9-2vqx-r6jm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103258"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-2.39.6-and-2.40-x-before-2.40.1-filter-bypass-via-parameter-interpolation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-FWPQ-CRRQ-C5XC

Vulnerability from github – Published: 2026-09-10 21:31 – Updated: 2026-09-10 21:31
VLAI
Details

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
6.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-88036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T19:17:41Z",
    "severity": "MODERATE"
  },
  "details": "Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.",
  "id": "GHSA-fwpq-crrq-c5xc",
  "modified": "2026-09-10T21:31:35Z",
  "published": "2026-09-10T21:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88036"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/CDRIVER-6427"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-G995-5P95-2FW6

Vulnerability from github – Published: 2026-09-29 12:31 – Updated: 2026-09-29 21:33
VLAI
Details

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the query.

The names are frequently not written by the Dag author. In a wildcard gcs_to_gdrive transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them — typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.

Affects deployments passing externally-sourced names to the Google Drive hook, including wildcard gcs_to_gdrive transfers from buckets writable by less-trusted principals. Users are advised to upgrade to apache-airflow-providers-google 22.6.0 or later, which escapes quote and backslash characters in every value interpolated into a Drive query.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-81914"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T10:17:12Z",
    "severity": "MODERATE"
  },
  "details": "Apache Airflow\u0027s Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker\u0027s choosing to the query.\n\nThe names are frequently not written by the Dag author. In a wildcard `gcs_to_gdrive` transfer they come from the source bucket listing, so anyone able to create objects in that bucket controls them \u2014 typically an external data producer or an ingest-only service account, a different trust principal from the Dag author. An injected clause can broaden the match and so steer which file or folder the hook resolves: an upload can be directed into a folder the attacker named, and, because downloads select the most recently modified match, a download can return a file they placed rather than the one the Dag asked for.\n\nAffects deployments passing externally-sourced names to the Google Drive hook, including wildcard `gcs_to_gdrive` transfers from buckets writable by less-trusted principals. Users are advised to upgrade to `apache-airflow-providers-google` `22.6.0` or later, which escapes quote and backslash characters in every value interpolated into a Drive query.",
  "id": "GHSA-g995-5p95-2fw6",
  "modified": "2026-09-29T21:33:09Z",
  "published": "2026-09-29T12:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81914"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/72166"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/90osv795jrqds051y7v3lcdzhsospooo"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/29/13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GCP9-5JC8-976X

Vulnerability from github – Published: 2026-04-01 23:41 – Updated: 2026-04-06 23:17
VLAI
Summary
phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure
Details

Summary

The searchCustomPages() method in phpmyfaq/src/phpMyFAQ/Search.php uses real_escape_string() (via escape()) to sanitize the search term before embedding it in LIKE clauses. However, real_escape_string() does not escape SQL LIKE metacharacters % (match any sequence) and _ (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records — including content that was not meant to be surfaced — resulting in information disclosure.

Details

File: phpmyfaq/src/phpMyFAQ/Search.php, lines 226–240

Vulnerable code:

$escapedSearchTerm = $this->configuration->getDb()->escape($searchTerm);
$searchWords = explode(' ', $escapedSearchTerm);
$searchConditions = [];

foreach ($searchWords as $word) {
    if (strlen($word) <= 2) {
        continue;
    }
    $searchConditions[] = sprintf(
        "(page_title LIKE '%%%s%%' OR content LIKE '%%%s%%')",
        $word,
        $word
    );
}

escape() calls mysqli::real_escape_string(), which escapes characters like ', \, NULL, etc. — but explicitly does not escape % or _, as these are not SQL string delimiters. They are, however, LIKE pattern wildcards.

Attack vector:

A user submits a search term containing _ or % as part of a 3+ character word (to bypass the strlen <= 2 filter). Examples:

  • Search for a_b → LIKE becomes '%a_b%' → _ matches any single character, e.g. matches "aXb", "a1b", "azb" — broader than the literal string a_b
  • Search for te%t → LIKE becomes '%te%t%' → matches test, text, te12t, etc.
  • Search for _%_ → LIKE becomes '%_%_%' → matches any record with at least one character, effectively dumping all custom pages

This allows an attacker to retrieve custom page content that would not appear in normal exact searches, bypassing intended search scope restrictions.

PoC

  1. Navigate to the phpMyFAQ search page (accessible to unauthenticated users by default).
  2. Submit a search query: _%_ (underscore, percent, underscore — length 3, bypasses the <= 2 filter).
  3. The backend executes: WHERE (page_title LIKE '%_%_%' OR content LIKE '%_%_%')
  4. This matches all custom pages with at least one character in title or content — returning content that would not appear for a specific search term.

Impact

  • Authentication required: None — search is publicly accessible
  • Affected component: searchCustomPages() in Search.php; custom pages (faqcustompages table)
  • Impact: Unauthenticated users can enumerate/disclose all custom page content regardless of the intended search term filter
  • Fix: Escape % and _ in LIKE search terms before interpolation: php $word = str_replace(['\\', '%', '_'], ['\\\\', '\\%', '\\_'], $word); Or use parameterized queries with properly escaped LIKE values.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "thorsten/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:41:49Z",
    "nvd_published_at": "2026-04-02T15:16:51Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe `searchCustomPages()` method in `phpmyfaq/src/phpMyFAQ/Search.php` uses `real_escape_string()` (via `escape()`) to sanitize the search term before embedding it in LIKE clauses. However, `real_escape_string()` does **not** escape SQL LIKE metacharacters `%` (match any sequence) and `_` (match any single character). An unauthenticated attacker can inject these wildcards into search queries, causing them to match unintended records \u2014 including content that was not meant to be surfaced \u2014 resulting in information disclosure.\n\n### Details\n\n**File:** `phpmyfaq/src/phpMyFAQ/Search.php`, lines 226\u2013240\n\n**Vulnerable code:**\n```php\n$escapedSearchTerm = $this-\u003econfiguration-\u003egetDb()-\u003eescape($searchTerm);\n$searchWords = explode(\u0027 \u0027, $escapedSearchTerm);\n$searchConditions = [];\n\nforeach ($searchWords as $word) {\n    if (strlen($word) \u003c= 2) {\n        continue;\n    }\n    $searchConditions[] = sprintf(\n        \"(page_title LIKE \u0027%%%s%%\u0027 OR content LIKE \u0027%%%s%%\u0027)\",\n        $word,\n        $word\n    );\n}\n```\n\n`escape()` calls `mysqli::real_escape_string()`, which escapes characters like `\u0027`, `\\`, `NULL`, etc. \u2014 but explicitly does **not** escape `%` or `_`, as these are not SQL string delimiters. They are, however, LIKE pattern wildcards.\n\n**Attack vector:**\n\nA user submits a search term containing `_` or `%` as part of a 3+ character word (to bypass the `strlen \u003c= 2` filter). Examples:\n\n- Search for `a_b` \u2192 LIKE becomes `\u0027%a_b%\u0027` \u2192 `_` matches any single character, e.g. matches `\"aXb\"`, `\"a1b\"`, `\"azb\"` \u2014 broader than the literal string `a_b`\n- Search for `te%t` \u2192 LIKE becomes `\u0027%te%t%\u0027` \u2192 matches `test`, `text`, `te12t`, etc.\n- Search for `_%_` \u2192 LIKE becomes `\u0027%_%_%\u0027` \u2192 matches any record with at least one character, effectively dumping all custom pages\n\nThis allows an attacker to retrieve custom page content that would not appear in normal exact searches, bypassing intended search scope restrictions.\n\n### PoC\n\n1. Navigate to the phpMyFAQ search page (accessible to unauthenticated users by default).\n2. Submit a search query: `_%_` (underscore, percent, underscore \u2014 length 3, bypasses the `\u003c= 2` filter).\n3. The backend executes: `WHERE (page_title LIKE \u0027%_%_%\u0027 OR content LIKE \u0027%_%_%\u0027)`\n4. This matches **all** custom pages with at least one character in title or content \u2014 returning content that would not appear for a specific search term.\n\n### Impact\n\n- **Authentication required:** None \u2014 search is publicly accessible\n- **Affected component:** `searchCustomPages()` in `Search.php`; custom pages (faqcustompages table)\n- **Impact:** Unauthenticated users can enumerate/disclose all custom page content regardless of the intended search term filter\n- **Fix:** Escape `%` and `_` in LIKE search terms before interpolation:\n  ```php\n  $word = str_replace([\u0027\\\\\u0027, \u0027%\u0027, \u0027_\u0027], [\u0027\\\\\\\\\u0027, \u0027\\\\%\u0027, \u0027\\\\_\u0027], $word);\n  ```\n  Or use parameterized queries with properly escaped LIKE values.",
  "id": "GHSA-gcp9-5jc8-976x",
  "modified": "2026-04-06T23:17:56Z",
  "published": "2026-04-01T23:41:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gcp9-5jc8-976x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34973"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpMyFAQ"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "phpMyFAQ has a LIKE Wildcard Injection in Search.php \u2014 Unescaped % and _ Metacharacters Enable Broad Content Disclosure"
}

GHSA-GF3F-XG7M-H8WP

Vulnerability from github – Published: 2026-09-10 18:31 – Updated: 2026-09-10 18:31
VLAI
Details

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
6.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-88031"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T18:18:13Z",
    "severity": "MODERATE"
  },
  "details": "Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.",
  "id": "GHSA-gf3f-xg7m-h8wp",
  "modified": "2026-09-10T18:31:49Z",
  "published": "2026-09-10T18:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88031"
    },
    {
      "type": "WEB",
      "url": "https://jira.mongodb.org/browse/GODRIVER-4081"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-GG5M-55JJ-8M5G

Vulnerability from github – Published: 2026-03-12 17:26 – Updated: 2026-03-13 13:36
VLAI
Summary
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Details

Summary

Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.node_labels were concatenated directly into Cypher label expressions without validation.

In MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call search_nodes with attacker-controlled entity_types values. The MCP server mapped entity_types to SearchFilters.node_labels, which then reached the vulnerable Cypher construction path.

Affected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels.

This issue was mitigated in 0.28.2.

Affected Versions

  • 0.28.1 and earlier

Fixed Version

  • 0.28.2

Affected Components

  • Graphiti Core search filter construction
  • Graphiti MCP Server search_nodes when used by an LLM client processing untrusted prompts

Technical Details

Before 0.28.2, Graphiti joined SearchFilters.node_labels with | and inserted the result directly into Cypher label expressions in the shared search-filter constructors used by non-Kuzu providers.

The vulnerable logic was effectively:

  • node_labels = '|'.join(filters.node_labels)
  • node_label_filter = 'n:' + node_labels

The same pattern was also used in edge-search filter construction.

In MCP deployments, search_nodes accepted an entity_types argument and passed it directly to SearchFilters(node_labels=entity_types). An attacker who could influence prompts processed by an LLM client with Graphiti MCP access could use prompt injection to steer the model into invoking search_nodes with crafted entity_types values containing Cypher syntax. Those values would then be interpolated into Cypher before 0.28.2.

Impact

Successful exploitation could allow arbitrary Cypher execution within the privileges of the configured graph database connection, including:

  • reading graph data outside the intended search scope
  • modifying graph data
  • deleting graph data
  • bypassing logical group isolation enforced at the query layer

Additional Note on group_ids

Separately, the original report also identified a narrower issue in fulltext search query construction for unvalidated group_ids. That issue was distinct from the Cypher label-injection path described above and was also mitigated in 0.28.2.

Mitigation

Upgrade to 0.28.2 or later.

Version 0.28.2 added:

  • validation of SearchFilters.node_labels
  • defense-in-depth label validation in shared search-filter constructors
  • validation of entity node labels in persistence query builders
  • validation of group_ids in shared search fulltext helpers

Workarounds

If you cannot upgrade immediately:

  • do not expose Graphiti MCP tools to untrusted users or to LLM workflows that process untrusted prompt content
  • avoid passing untrusted values into SearchFilters.node_labels or MCP entity_types
  • restrict graph database credentials to the minimum privileges required

Credits

@4n93L for their original report.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.28.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "graphiti-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.28.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T17:26:16Z",
    "nvd_published_at": "2026-03-12T19:16:19Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nGraphiti versions before `0.28.2` contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through `SearchFilters.node_labels` were concatenated directly into Cypher label expressions without validation.\n\nIn MCP deployments, this was exploitable not only through direct untrusted access to the Graphiti MCP server, but also through prompt injection against an LLM client that could be induced to call `search_nodes` with attacker-controlled `entity_types` values. The MCP server mapped `entity_types` to `SearchFilters.node_labels`, which then reached the vulnerable Cypher construction path.\n\nAffected backends included Neo4j, FalkorDB, and Neptune. Kuzu was not affected by the label-injection issue because it used parameterized label handling rather than string-interpolated Cypher labels.\n\nThis issue was mitigated in `0.28.2`.\n\n### Affected Versions\n\n- `0.28.1` and earlier\n\n### Fixed Version\n\n- `0.28.2`\n\n### Affected Components\n\n- Graphiti Core search filter construction\n- Graphiti MCP Server `search_nodes` when used by an LLM client processing untrusted prompts\n\n### Technical Details\n\nBefore `0.28.2`, Graphiti joined `SearchFilters.node_labels` with `|` and inserted the result directly into Cypher label expressions in the shared search-filter constructors used by non-Kuzu providers.\n\nThe vulnerable logic was effectively:\n\n- `node_labels = \u0027|\u0027.join(filters.node_labels)`\n- `node_label_filter = \u0027n:\u0027 + node_labels`\n\nThe same pattern was also used in edge-search filter construction.\n\nIn MCP deployments, `search_nodes` accepted an `entity_types` argument and passed it directly to `SearchFilters(node_labels=entity_types)`. An attacker who could influence prompts processed by an LLM client with Graphiti MCP access could use prompt injection to steer the model into invoking `search_nodes` with crafted `entity_types` values containing Cypher syntax. Those values would then be interpolated into Cypher before `0.28.2`.\n\n### Impact\n\nSuccessful exploitation could allow arbitrary Cypher execution within the privileges of the configured graph database connection, including:\n\n- reading graph data outside the intended search scope\n- modifying graph data\n- deleting graph data\n- bypassing logical group isolation enforced at the query layer\n\n### Additional Note on `group_ids`\n\nSeparately, the original report also identified a narrower issue in fulltext search query construction for unvalidated `group_ids`. That issue was distinct from the Cypher label-injection path described above and was also mitigated in `0.28.2`.\n\n### Mitigation\n\nUpgrade to `0.28.2` or later.\n\nVersion `0.28.2` added:\n\n- validation of `SearchFilters.node_labels`\n- defense-in-depth label validation in shared search-filter constructors\n- validation of entity node labels in persistence query builders\n- validation of `group_ids` in shared search fulltext helpers\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- do not expose Graphiti MCP tools to untrusted users or to LLM workflows that process untrusted prompt content\n- avoid passing untrusted values into `SearchFilters.node_labels` or MCP `entity_types`\n- restrict graph database credentials to the minimum privileges required\n\n### Credits\n\n@4n93L for their original report.",
  "id": "GHSA-gg5m-55jj-8m5g",
  "modified": "2026-03-13T13:36:04Z",
  "published": "2026-03-12T17:26:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getzep/graphiti/security/advisories/GHSA-gg5m-55jj-8m5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32247"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getzep/graphiti/pull/1312"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getzep/graphiti/commit/7d65d5e77e89a199a62d737634eaa26dbb04d037"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getzep/graphiti"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getzep/graphiti/releases/tag/v0.28.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters"
}

GHSA-GPV6-M7FJ-WR5V

Vulnerability from github – Published: 2025-11-11 03:30 – Updated: 2025-11-11 03:30
VLAI
Details

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-42884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T01:15:36Z",
    "severity": "MODERATE"
  },
  "details": "SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.\ufffdThis could further lead to disclosure or modification of information about the server. There is no impact on availability.",
  "id": "GHSA-gpv6-m7fj-wr5v",
  "modified": "2025-11-11T03:30:28Z",
  "published": "2025-11-11T03:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42884"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3660969"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-GPVQ-4WMP-CP47

Vulnerability from github – Published: 2026-10-01 12:31 – Updated: 2026-10-01 12:31
VLAI
Details

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
7.0 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-103250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-01T11:17:18Z",
    "severity": "HIGH"
  },
  "details": "n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations.",
  "id": "GHSA-gpvq-4wmp-cp47",
  "modified": "2026-10-01T12:31:16Z",
  "published": "2026-10-01T12:31:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-w24g-6454-7w7f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103250"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-nosql-injection-via-mongodb-chat-memory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-GR2V-3FHG-H4JH

Vulnerability from github – Published: 2026-01-31 00:30 – Updated: 2026-01-31 00:30
VLAI
Details

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-36353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-943"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-30T22:15:53Z",
    "severity": "MODERATE"
  },
  "details": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.",
  "id": "GHSA-gr2v-3fhg-h4jh",
  "modified": "2026-01-31T00:30:28Z",
  "published": "2026-01-31T00:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36353"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7257632"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-676: NoSQL Injection

An adversary targets software that constructs NoSQL statements based on user input or with parameters vulnerable to operator replacement in order to achieve a variety of technical impacts such as escalating privileges, bypassing authentication, and/or executing code.

← Back to the CWE list