{"id":"CVE-2026-124850","published":"2026-11-09T15:17:19.020","lastModified":"2026-11-09T15:17:19.020","description":"A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can result in unauthorized data disclosure, modification, or deletion\n\nAffected versions: flowintel prior to 4.0.0","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d","tags":[]}],"exploitRefs":[{"url":"https://github.com/flowintel/flowintel/commit/061053689dc279a3c2c182f8dc15cd42dc24bd7d","tags":[]}],"hasPoc":true,"ai":null}