Erupt CVE-2026-4594

Remote unauthenticated attacker can exploit erupts erupt versions up to 1.13.3 by manipulating the sort.field parameter in the geneEruptHqlOrderBy function to inject SQL via Hibernate. No special configuration or victim interaction required.

The real-world risk is HIGH and this should be prioritized for remediation. The CVSS v3.1 score of 7.3 reflects critical risk factors: network-based attack vector (AV:N), low attack complexity (AC:L), and no authentication required (PR:N). Most concerning is the public availability of a working exploit (E:P) as evidenced by the Feishu document reference containing proof-of-concept code, transforming this from theoretical to immediately exploitable. The CVSS vector indicates impact across all three security pillars (C:L/I:L/A:L), meaning attackers can read, modify, and disrupt data. The vendor's non-responsiveness (RL:X indicating no official remedy) compounds the risk, leaving users without vendor-supported patches. This vulnerability is automatable given the low complexity and remote exploitation vector, making it attractive for both targeted attacks and mass scanning campaigns. Organizations running affected versions should treat this as an active threat requiring immediate action.

An unauthenticated remote attacker crafts a malicious HTTP request to the erupt application, targeting an endpoint that uses the vulnerable sorting functionality. The attacker manipulates the sort.field parameter with HQL injection payloads such as '(CASE WHEN (SELECT COUNT(*) FROM User)>0 THEN id ELSE name END)' to exfiltrate data or '1=1; DELETE FROM SensitiveTable--' to manipulate database records. Since a public proof-of-concept is available via the Feishu document reference, attackers can readily adapt the disclosed exploit code to target vulnerable installations, requiring minimal technical sophistication due to the low attack complexity.