Description
The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as “trusted SQL”). There is no allowlist, no parameterized query binding, and no input validation.
Recommendation
Update the oneuptime package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.23
- Patched version(s): 10.0.23
References
Could your website be exposed too?
SmartScanner can check your website for OneUptime ClickHouse SQL Injection via Aggregate Query Parameters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet - CVE-2026-33142
- Payload has an SQL Injection via Query Handling - CVE-2026-34747
- Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
You might also like:
See something that needs correcting? Let us knowUpdated March 16, 2026