CVE-2026-63489: high-severity vulnerability in yeti-platform yeti
Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 0.3%
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected products
yeti-platform · yetiRelated CVEs — yeti-platform yeti
In the same product, most dangerous first.
CVE-2024-45412MEDIUMYeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackEPSS 0.8%CVE-2026-92783HIGHYeti through 2.11.0 Missing Authorization on RBAC Relationship DeletionEPSS 0.5%CVE-2026-63482HIGHYeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence DataEPSS 0.4%CVE-2026-63502HIGHYeti: Path traversal in ExportTask name allows authenticated arbitrary file read and writeEPSS 0.4%CVE-2026-63500HIGHYeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive exportEPSS 0.4%