EUVD-2026-36680
GHSA-8237-h92m-mj9j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQLi requires authenticated low-privilege access (PR:L); limited declared impact (L/L/L) reflects described scope, though real SQLi often enables higher data access.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file modules/assays/backend/app/models/grit/assays/data_table_entity.rb. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Grit42 Grit through version 0.11.0 allows remote low-privileged attackers to manipulate database queries via the DataTableEntity function in the assays module backend. The CVSS 4.0 vector (AV:N/PR:L/E:P) indicates network-exploitable, low-complexity exploitation by authenticated users with a publicly available proof-of-concept. The vendor was notified but did not respond, leaving no official patch available at time of analysis.
Technical ContextAI
Grit42 Grit is a Ruby on Rails-based laboratory/assay data management platform. The vulnerability resides in the Grit::Assays::DataTableEntity model at modules/assays/backend/app/models/grit/assays/data_table_entity.rb. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies this as a failure to sanitize user-controlled input before embedding it in SQL queries - a classic ORM misuse or raw SQL concatenation pattern in Rails. The affected CPE is cpe:2.3:a:grit42:grit:*:*:*:*:*:*:*:* covering all versions up to and including 0.11.0. SQL injection at the model layer in Rails typically implies either misuse of string interpolation in ActiveRecord queries (e.g., where('column = ' + user_input)) or use of raw SQL fragments without parameterization.
RemediationAI
No vendor-released patch is available at time of analysis; the vendor did not respond to the coordinated disclosure. Organizations should treat this as an unpatched vulnerability until a fix is issued. Specific compensating controls in priority order: first, restrict access to the Grit assays DataTableEntity endpoint at the network or application layer to trusted authenticated users only - reduce the authenticated user population to the minimum necessary; second, deploy a web application firewall (WAF) with SQL injection detection rules in front of the Grit application, noting that WAF bypass is possible with obfuscated payloads and this is a temporary measure only; third, enable database-level query logging and alerting for anomalous patterns (e.g., UNION SELECT, stacked queries) targeting the assays database schema; fourth, consider isolating the Grit database with least-privilege credentials so the application account cannot read sensitive system tables or execute administrative commands. Monitor the VulDB entry at https://vuldb.com/vuln/370848 and the GitHub research repository for any upstream patch or commit: https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/SQL%20Injection%20in%20grit42%20Data%20Table%20Entity%20Endpoint.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today