Chirpstack
Monthly
SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in `chirpstack/src/storage/device.rs` within both `get_count()` and `list()`, where the tag KEY is concatenated into raw SQL via Rust's `format!()` macro while only the tag VALUE receives safe parameterization through Diesel's `.bind()`. Only deployments using the `chirpstack-sqlite` package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in `chirpstack/src/storage/device.rs` within both `get_count()` and `list()`, where the tag KEY is concatenated into raw SQL via Rust's `format!()` macro while only the tag VALUE receives safe parameterization through Diesel's `.bind()`. Only deployments using the `chirpstack-sqlite` package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.