CVE-2026-111634: high-severity vulnerability in helicalinsight
Helical Insight through 7.0.0 SQL Injection via /executeDatasource
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.3%
exploitation probability
0.3%top 83% of all CVEs
observed exploitation
nono source reports it
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
helicalinsight · helicalinsightRelated CVEs — helicalinsight
In the same product, most dangerous first.
References
https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/datasource/EfwdQueryProcessor.java#L220-L235https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqlihttps://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource