{"id":"CVE-2026-121881","published":"2026-11-06T16:17:53.160","lastModified":"2026-11-06T20:38:53.570","description":"SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter.\n\n\n\nNOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","tags":[]},{"url":"https://trust.posit.co/updates","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}