AIKIDO-2024-10432
@grafana/data is vulnerable to Code Injection
98
@grafana/data js
AIKIDO-2024-10432: @grafana/data is vulnerable to Code Injection in versions 11.0.0 - 11.0.4, 11.1.0 - 11.1.5 and 11.2.0 - 11.2.0.
Affected versions of the package are vulnerable to code injection. The vulnerability was in an experimental feature named SQL Expressions that allows for data source query output to be post-processed by executing one or more SQL queries. It does this by passing the query and data to the DuckDB CLI, which executes the SQL against the DataFrame data. These SQL queries were not sanitized completely, leading to a command injection and local file inclusion vulnerability.
You're affected if you are using a version which is within vulnerability ranges and the system must have DuckDB installed and included in Grafana’s PATH.
Upgrade grafana/data library to patch version.
Don’t be left in the dark
With in-house intel and access to top vulnerability databases, see it all with Aikido.
