CVE-2026-42093

The Redash data visualization package (versions after 8.0.0 until 26.9.0 ) is vulnerable to SQL Injection in the Query Results query runner located in redash/query_runner/query_results.py. The flaw occurs because the system accepts param_query_N_{key=value} parameters and passes attacker-controll...