CLEANSTART-2025-OD67243

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2025/CLEANSTART-2025-OD67243.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2025-OD67243
Upstream
Published
2026-10-31T13:54:57Z
Modified
2026-10-31T16:03:35Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input
Details

Security vulnerability affects the grafana package. The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input.

References

Affected packages

CleanStart / grafana

Package

Name
grafana
Purl
pkg:apk/cleanstart/grafana

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.0.7-r0

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2025/CLEANSTART-2025-OD67243.json"