OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

Description

The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as “trusted SQL”). There is no allowlist, no parameterized query binding, and no input validation.

Recommendation

Update the oneuptime package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.23
• Patched version(s): 10.0.23

References

• GHSA-p5g2-jm85-8g35
• CVE-2026-32306
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet - CVE-2026-33142
• Payload has an SQL Injection via Query Handling - CVE-2026-34747
• Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that - CVE-2026-33468
• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

oneuptime