EUVD-2026-36667
GHSA-crh6-pvh7-v7wf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQL injection requiring low-privilege authentication; low CIA impact consistent with constrained database role and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb of the component GritEntityController. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Grit42 Grit up to version 0.11.0 allows authenticated low-privilege remote attackers to query or manipulate the backend database through a CSV export endpoint handled by the GritEntityController Rails concern. The vulnerable code path resides in shared controller logic at modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb, meaning the injection surface may extend across multiple entity types rather than a single isolated route. A public proof-of-concept exploit exists via a researcher's GitHub repository, no vendor patch has been released, and the vendor was unresponsive to responsible disclosure - leaving deployments without an official remediation path.
Technical ContextAI
Grit42 Grit (CPE: cpe:2.3:a:grit42:grit:*:*:*:*:*:*:*:*) is a Ruby on Rails application whose GritEntityController is implemented as a Rails concern - a module of reusable controller logic mixed into multiple controllers. This architectural pattern means the SQL injection flaw in this concern is likely inherited by every controller that includes it, broadening the attack surface beyond a single endpoint. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled parameters supplied to the CSV export endpoint are incorporated into database queries without adequate parameterization or escaping. The researcher's PoC specifically identifies the CSV export endpoint as the injection point, suggesting filter or sort parameters passed to generate database-backed CSV output are unsanitized before reaching the ORM or raw SQL layer.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure and no fix version exists to reference. As an immediate compensating control, restrict access to the CSV export endpoint to only trusted, operationally necessary users - enforce this at the reverse-proxy or web-server layer rather than solely relying on application-layer controls. If the CSV export feature is not required, disable it by removing or commenting out the relevant route in the Rails router, which eliminates this attack surface entirely with no side effects for users who do not depend on it. Deploy a Web Application Firewall with SQL injection detection signatures targeting the GritEntityController endpoint; note that WAF bypass remains possible for skilled attackers and should not be treated as a complete fix. Review and restrict the database role used by the Grit application to the minimum required privileges - scoping it to SELECT on specific tables reduces worst-case impact of a successful injection. Continuously monitor database and application logs for anomalous query patterns such as UNION-based or time-delay payloads. Track VulDB entry 370834 (https://vuldb.com/vuln/370834) for any future vendor patch releases.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today