Description
The fix for GHSA-p5g2-jm85-8g35 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator.
Recommendation
Update the oneuptime package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.34
- Patched version(s): 10.0.34
References
Could your website be exposed too?
SmartScanner can check your website for OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime ClickHouse SQL Injection via Aggregate Query Parameters - CVE-2026-32306
- Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
- Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) - CVE-2026-41478
- Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739
You might also like:
See something that needs correcting? Let us knowUpdated March 20, 2026