CVE-2026-111634
8.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-89
Impact
Authenticated viewers can read or modify arbitrary data in the report's underlying database. They only need standard viewer access to send crafted requests to the /executeDatasource endpoint.
Root cause
The SqlDetect input filter fails to properly sanitize Numeric and String placeholder values before concatenating them into SQL queries in EfwdQueryProcessor.
Affected systems
Helical Insight through 7.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to a version newer than 7.0.0 once released by the vendor; in the interim, block network access to the /executeDatasource endpoint or revoke report viewing access for untrusted accounts.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
References
- https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/datasource/EfwdQueryProcessor.java#L220-L235
- https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
- https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource