CVE-2026-42093

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42093

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42093.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42093

Aliases

GHSA-v43x-rgcc-wh77

Published

2026-10-14T18:00:03Z

Modified

2026-10-15T10:30:52Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Redash: SQL Injection via Query Results parameterized query substitution

Details

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42093.json"
}

References

Affected packages

Git / github.com/getredash/redash

Affected ranges

Type

GIT

Repo

https://github.com/getredash/redash

Events

Introduced

a16f551e22c6288df6f067aa12caa5afd9a8f1dd

Fixed

42fdf9d4a0fdb83841130ab78f69899a224f281b

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "8.0.0"
        },
        {
            "fixed":  "26.9.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42093.json"