EUVD-2026-17131
GHSA-wfp6-2cvw-9pcm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go.
AnalysisAI
SQL injection in SchemaHero 0.23.0 allows remote attackers to execute arbitrary SQL commands through the column parameter in the columnAsInsert function within the PostgreSQL plugin, potentially compromising database integrity and confidentiality. Public exploit documentation is available, indicating proof-of-concept code exists. CVSS and EPSS data are unavailable, limiting formal severity quantification.
Technical ContextAI
SchemaHero is a Kubernetes-native schema management tool that interacts with database systems including PostgreSQL. The vulnerability exists in the PostgreSQL plugin's column.go file, specifically in the columnAsInsert function, which constructs SQL statements based on user-supplied column parameters. The root cause is improper input validation or parameterization of SQL queries, allowing attackers to inject malicious SQL code. This is a classical SQL injection flaw (CWE category) arising from insufficient sanitization of the column parameter before incorporation into dynamically constructed SQL statements.
RemediationAI
Upgrade SchemaHero to a patched version released after 0.23.0; consult the official SchemaHero GitHub repository (https://github.com/schemahero/schemahero) for the latest stable release and security advisories. As an interim measure pending patch availability, restrict access to SchemaHero deployment endpoints using network segmentation, firewall rules, or Kubernetes network policies, and limit database credentials to the minimum necessary privilege scope. Ensure all column parameter inputs undergo strict validation and parameterized query construction to prevent injection. Review the proof-of-concept documentation at https://github.com/b0b0haha/SchemaHero--Sqlinjection to understand attack vectors and validate remediation effectiveness.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query strin
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today