CVE-2026-63489

In Yeti version 2.5.0 and earlier, a low-privileged authenticated user can perform AQL injection due to the direct interpolation of user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifiers within core/database_arango.py . Attackers can send crafted values to...