duckdb

Jepsen DuckDB Test Jepsen tests for the DucKDB database. Runs locally, rather than on a remote cluster. The test spawns a collection of local processes which open a DuckDB file locally, and interacts with them over STDIN/STDOUT. This is an early prototype. It turns on, runs transactions, checks...

CVE-2024-9264

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Python proof of concept for CVE-2024-9264, a Grafana SQL Expressions vulnerability that can allow authenticated local file inclusion and command execution when duckdb is available in the Grafana process PATH. For authorized testing and...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit This is a fixed version of the proof-of-concept exploit for CVE-2024-9264 , a critical remote code execution vulnerability in Grafana via SQL expressions and DuckDB. 🔗 Original advisory: Grafana Security Release ❌ Original PoC: Broken due to syntax...

File-Read-CVE-2024-9264

File-Read-CVE-2024-9264 Proof Of Concept for File Read in Grafana CVE-2024-9264 Prerequisites authenticated Grafana user with Viewer permissions or higher DuckDB binary must be installed and accessible through Grafana's PATH Impacted version Grafana = v11.0.0 all v11.x.y are impacted Usage python...

CVE-2024-9264

CVE-2024-9264 Authenticated RCE in Grafana v11.0 via SQL Expressions - PoC Exploit CVE-2024-9264 - Grafana v11.0 Authenticated Remote Code Execution RCE PoC Introduction CVE-2024-9264 is a critical remote-code-execution and local-file-inclusion flaw introduced in Grafana 11’s experimental “SQL...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-77371

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

EUVD-2026-101518

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371

The Redash data visualization package versions 26.0.0 through 26.9.0 are vulnerable due to a misconfiguration in the DuckDB query runner located at redash/query_runner/duckdb.py. The _connect() path fails to disable enable_external_access , leaving it at its default value of true. A user with que...

...[ More ]

This Metasploit module exploits an authenticated command injection vulnerability in Grafana's experimental SQL Expressions feature. Affected Grafana releases are 11.0.0 through 11.0.6, 11.1.0 through 11.1.7, and 11.2.0 through 11.2.2. They pass attacker-controlled SQL expressions to DuckDB withou...

CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

CVE-2024-9264

CVE-2024-9264 Grafana Post-Auth DuckDB SQL Injection RCE, File Read Proof of Concept PoC This PoC demonstrates the exploitation of CVE-2024-9264 using an authenticated user to perform a DuckDB SQL query and read an arbitrary file on the filesystem or execute arbitrary code remotely. Arbitrary cod...

CVE-2024-9264

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...

GHSA-F46Q-3V67-FMM4 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Summary The V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can execute arbitrary SQL statements against all data accessible through the...