Skip to content
OpenAdvisories

Vendor

cube-js

4 known vulnerabilities.

Products

cube 3 cube.js 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2022-23510

    SQl injection in cube-js

    cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24…

    cube-js cube.js @cubejs-backend/api-gateway npm