Lucene search
+L

2 matches found

OSV
OSV
added 2023/07/06 9:5 p.m.99 views

GHSA-JQHC-M2J3-FJRX SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

6.3CVSS7.1AI score0.00414EPSS
SaveExploits1References6
Github Security Blog
Github Security Blog
added 2023/07/06 9:5 p.m.38 views

SQLFluff users with access to config file, using `libary_path` may call arbitrary python code

Impact In environments where untrusted users have access to the config files e.g. .sqlfluff, there is a potential security vulnerability where those users could use the librarypath config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a sandboxed...

7.8CVSS6.8AI score0.00414EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder