CVE-2026-63224

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the "datapoint export" API constructs "CSV crosstab" SQL by concatenating an "asset name" and "attribute name" into a "COPY" query that uses "crosstab" and streams "TO STDOUT". The "asset name" enters both a double-quoted...