CVE-2026-115331

8.8 Élevée

Publiée le 22/10/2026 à 13:17 · Modifiée le 22/10/2026 à 13:17 · Reçue · Source : disclosure@vulncheck.com

Description

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.

Traduire en français

Produits concernés

uselotus lotus

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.7 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	8.8 Élevée	disclosure@vulncheck.com (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-89

Références

https://github.com/uselotus/lotus
https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/counter_query_templates.py#L14
https://hackmd.io/@leediay/BkUc3WL2Mx
https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories