OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet

Description

The fix for GHSA-p5g2-jm85-8g35 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction paths in StatementGenerator.

Recommendation

Update the oneuptime package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.34
• Patched version(s): 10.0.34

References

• GHSA-gcg3-c5p2-cqgg
• CVE-2026-33142
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• OneUptime ClickHouse SQL Injection via Aggregate Query Parameters - CVE-2026-32306
• Drizzle ORM has SQL injection via improperly escaped SQL identifiers - CVE-2026-39356
• Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) - CVE-2026-41478
• Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline - CVE-2026-27739

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

oneuptime