| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/grafana/grafana | ≥ 11.0.0, < 11.0.6+security-01≥ 11.1.0, < 11.1.7+security-01≥ 11.2.0, < 11.2.2+security-01all versions | 11.0.6+security-0111.1.7+security-0111.2.2+security-01 |
| grafana | = 11.0.0 |
The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free