EUVD-2026-29728Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible /assets endpoint requires only a valid authenticated session (PR:L); read-only SQL injection grants high confidentiality impact with no integrity or availability consequence.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route allows any authenticated user (any role) to execute arbitrary SQL and read data from any table in the database, including data belonging to other organizations. This vulnerability is fixed in 1.20.1.
AnalysisAI
SQL injection in shelf.nu's /assets route exposes cross-organizational database contents to any authenticated user regardless of role, affecting versions 1.12 through 1.20.0. The injection point is the sortBy query parameter's direction component, where unsanitized input is passed directly into Prisma.raw() SQL construction. A PoC is confirmed by regression tests in the fix commit (GHSA-69xv-wmgg-3qp3); no CISA KEV listing exists and EPSS sits at 0.04%, indicating limited observed exploitation activity at time of analysis.
Technical ContextAI
Shelf (shelf.nu) is an open-source physical asset tracking web application. The vulnerability resides in apps/webapp/app/modules/asset/filter-parsing.ts, where the sortBy query parameter is parsed into a column name and sort direction before being interpolated into raw SQL via Prisma's Prisma.raw() method. The column name segment had a local SAFE_SQL_IDENTIFIER regex guard, but the direction segment (expected to be 'asc' or 'desc') received no equivalent validation, allowing attackers to append arbitrary SQL subqueries such as asc,(SELECT CASE WHEN 1=2 THEN 1 ELSE 1/0 END). CWE-20 (Improper Input Validation) captures this root cause: the application failed to validate that the direction token was strictly one of the allowed values before constructing raw SQL. The fix in commit 5d35c15856dbf267fab4dccafd077ee7a6fa6f40 centralizes identifier validation through a shared isSafeSqlIdentifier utility and adds strict allowlisting of the direction value, with regression tests covering the exact reporter PoC payload shape.
RemediationAI
Upgrade to shelf.nu version 1.20.1, which is the vendor-confirmed patched release per advisory GHSA-69xv-wmgg-3qp3. The underlying fix is in commit 5d35c15856dbf267fab4dccafd077ee7a6fa6f40, which centralizes SQL identifier validation via a shared isSafeSqlIdentifier utility and adds strict direction-value allowlisting with regression coverage. If an immediate upgrade is not feasible, restrict access to the /assets route to the smallest possible set of trusted users via network controls or application-layer authentication gating - this does not eliminate the vulnerability but limits the pool of accounts that can exploit it. Deploying a WAF rule to reject sortBy parameter values containing semicolons, parentheses, or SQL keywords can provide additional defense-in-depth but may block legitimate future sorting features and is not a substitute for patching. See https://github.com/Shelf-nu/shelf.nu/security/advisories/GHSA-69xv-wmgg-3qp3 for full vendor guidance.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today