Read the docs
TI-2022-07569 Aliases CVE-2022-23510GHSA-6jqm-3c9g-pch7

SQl injection in cube-js

Priority MEDIUM 45CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24. Users are advised to either upgrade to 0.31.24 or to downgrade to 0.31.22. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00974 62nd percentileScored 2026-11-07
Fix Fixed @cubejs-backend/api-gateway (npm): 0.31.24

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cube-jscube.js= 0.31.23—No fix listedCNA
—@cubejs-backend/api-gateway (npm)0.31.23 to before 0.31.240.31.24Patch availableGHSA-6jqm-3c9g-pch7
  • cube.js Vendorcube-js Affected = 0.31.23 Fixed in — No fix listed CNA
  • @cubejs-backend/api-gateway (npm) Vendor— Affected 0.31.23 to before 0.31.24 Fixed in 0.31.24 Patch available GHSA-6jqm-3c9g-pch7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cube:cube.js:0.31.23:*:*:*:*:node.js:*:*0.31.23Vulnerablecube-js
  • cpe:2.3:a:cube:cube.js:0.31.23:*:*:*:*:node.js:*:* Versions 0.31.23 Vulnerable ·cube-js

Remediation

  • Fix · GHSA-6jqm-3c9g-pch7 @cubejs-backend/api-gateway (npm) Fixed in 0.31.24 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23510
  2. 2026-10-03 Alias added: GHSA-6jqm-3c9g-pch7

References

Patch 2

Advisory 2

Other 1

  • TI-2026-20983 Cube privilege escalation via a specially crafted request CVSS 3.1HIGH 7.7
  • TI-2023-27655 Denial of service attack on the cube-api endpoint CVSS 3.1HIGH 7.5
  • TI-2026-20982 Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences