Openmeter
Monthly
Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).
Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).