EUVD-2026-17131
GHSA-wfp6-2cvw-9pcm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go.
AnalysisAI
SQL injection in SchemaHero 0.23.0 allows remote attackers to execute arbitrary SQL commands through the column parameter in the columnAsInsert function within the PostgreSQL plugin, potentially compromising database integrity and confidentiality. Public exploit documentation is available, indicating proof-of-concept code exists. CVSS and EPSS data are unavailable, limiting formal severity quantification.
Technical ContextAI
SchemaHero is a Kubernetes-native schema management tool that interacts with database systems including PostgreSQL. The vulnerability exists in the PostgreSQL plugin's column.go file, specifically in the columnAsInsert function, which constructs SQL statements based on user-supplied column parameters. The root cause is improper input validation or parameterization of SQL queries, allowing attackers to inject malicious SQL code. This is a classical SQL injection flaw (CWE category) arising from insufficient sanitization of the column parameter before incorporation into dynamically constructed SQL statements.
RemediationAI
Upgrade SchemaHero to a patched version released after 0.23.0; consult the official SchemaHero GitHub repository (https://github.com/schemahero/schemahero) for the latest stable release and security advisories. As an interim measure pending patch availability, restrict access to SchemaHero deployment endpoints using network segmentation, firewall rules, or Kubernetes network policies, and limit database credentials to the minimum necessary privilege scope. Ensure all column parameter inputs undergo strict validation and parameterized query construction to prevent injection. Review the proof-of-concept documentation at https://github.com/b0b0haha/SchemaHero--Sqlinjection to understand attack vectors and validate remediation effectiveness.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today