duckdb

Jepsen DuckDB Test Jepsen tests for the DucKDB database. Runs locally, rather than on a remote cluster. The test spawns a collection of local processes which open a DuckDB file locally, and interacts with them over STDIN/STDOUT. This is an early prototype. It turns on, runs transactions, checks...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2024-9264

CVE-2024-9264 Authenticated RCE in Grafana v11.0 via SQL Expressions - PoC Exploit CVE-2024-9264 - Grafana v11.0 Authenticated Remote Code Execution RCE PoC Introduction CVE-2024-9264 is a critical remote-code-execution and local-file-inclusion flaw introduced in Grafana 11’s experimental “SQL...

CVE-2024-9264

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2024-9264

CVE-2024-9264 Grafana Post-Auth DuckDB SQL Injection RCE, File Read Proof of Concept PoC This PoC demonstrates the exploitation of CVE-2024-9264 using an authenticated user to perform a DuckDB SQL query and read an arbitrary file on the filesystem or execute arbitrary code remotely. Arbitrary cod...

CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

File-Read-CVE-2024-9264

File-Read-CVE-2024-9264 Proof Of Concept for File Read in Grafana CVE-2024-9264 Prerequisites authenticated Grafana user with Viewer permissions or higher DuckDB binary must be installed and accessible through Grafana's PATH Impacted version Grafana = v11.0.0 all v11.x.y are impacted Usage python...

CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit This is a fixed version of the proof-of-concept exploit for CVE-2024-9264 , a critical remote code execution vulnerability in Grafana via SQL expressions and DuckDB. 🔗 Original advisory: Grafana Security Release ❌ Original PoC: Broken due to syntax...

CVE-2024-9264

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Python proof of concept for CVE-2024-9264, a Grafana SQL Expressions vulnerability that can allow authenticated local file inclusion and command execution when duckdb is available in the Grafana process PATH. For authorized testing and...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

CVE-2026-55098 Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

EUVD-2026-114443

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

CVE-2026-55098

The Arc time-series database contains a cross-database authorization bypass in versions prior to 26.06.2 . The vulnerability stems from an incomplete denylist in userSQLReadParquetPattern that fails to block specific DuckDB table-valued I/O functions such as parquet_scan, glob, parquet_metadata, ...

CVE-2026-55098: Basekick-Labs arc: Arc is an open, SQL-native time-series database for telemetry

Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of CVE-2026-47735 leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In internal/database/sandbox.go, alloweddirectories uses...

Grafana CVE-2024-9264 SQL Expressions RCE

CVE-2024-9264 Grafana 11.0.0–11.2.0: Viewer+ can run SQL Expressions with DuckDB readtext / shellfs for arbitrary file read and command execution when duckdb shellfs is available in PATH. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana CVE-2024-9264 SQL Expressions DuckDB authenticated RCE /...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

CVE-2026-112005

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use readtext, readblob, COPY ... ...

CVE-2026-112005

WhoDB versions 0.104.0 before 0.135.0 are vulnerable to a path traversal flaw within the DuckDB query editor . This vulnerability allows remote attackers to execute DuckDB filesystem functions, enabling them to read and write arbitrary host files . Specifically, attackers can access the session.k...