https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:36:29 +0000 https://cve.radiocsirt.org/vuln/cve-2026-29090 <p><strong>Affected:</strong> rucio</p> <p>### Summary</p> <p>A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/&lt;scope&gt;/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`&#39;s `sql.SQL()` which treats the string as trusted SQL syntax.</p> <p>Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.</p> <p><strong>Affected:</strong> rucio</p> <p>### Summary</p> <p>A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids/&lt;scope&gt;/dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`&#39;s `sql.SQL()` which treats the string as trusted SQL syntax.</p> <p>Depending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-29090 https://cve.radiocsirt.org/vuln/ghsa-6j7p-qjhg-9947 <p><strong>Affected:</strong> PyPI: rucio</p> <p>### Summary</p> <p>A SQL injection vulnerability in `FilterEngine.create_postgres_query` allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint (`GET /dids/&lt;scope&gt;/dids/search`). When the external metadata plugin `postgres_meta` is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL statements via Python `str.format`. This enables full database compromise including data exfiltration, data modification, and potential remote code execution via `COPY ... FROM PROGRAM`.</p> <p>---</p> <p>### Details</p> <p>The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_postgres_query()` method (lines 408-484). This method builds raw SQL strings via Python `.format()` across 6 distinct injection points:</p> <p>**filter_engine.py:477** (string equality — default branch): ```python expression = &#34;{}-&gt;&gt;&#39;{}&#39; {} &#39;{}&#39;&#34;.format(jsonb_column, key, POSTGRES_OP_MAP[oper], value) ```</p> <p>**filter_engine.py:442** (wildcard/LIKE branch): ```python expression = &#34;{}-&gt;&gt;&#39;{}&#39; LIKE &#39;{}&#39; &#34;.format(jsonb_column, key, value.replace(&#39;*&#39;, &#39;%&#39;)) ```</p> <p>**filter_engine.py:456** (boolean branch — value unquoted): ```python expression = &#34;({}-&gt;&gt;&#39;{}&#39; )::boolean {} {}&#34;.format(jsonb_column, key, POSTGRES_OP_MAP[oper], value) ```</p> <p>**filter_engine.py:462** (numeric branch — value unquoted): ```python expression = &#34;({}-&gt;&gt;&#39;{}&#39; )::float {} {}&#34;.format(jsonb_column, key, POSTGRES_OP_MAP[o…</p> <p><strong>Affected:</strong> PyPI: rucio</p> <p>### Summary</p> <p>A SQL injection vulnerability in `FilterEngine.create_postgres_query` allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint (`GET /dids/&lt;scope&gt;/dids/search`). When the external metadata plugin `postgres_meta` is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL statements via Python `str.format`. This enables full database compromise including data exfiltration, data modification, and potential remote code execution via `COPY ... FROM PROGRAM`.</p> <p>---</p> <p>### Details</p> <p>The vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_postgres_query()` method (lines 408-484). This method builds raw SQL strings via Python `.format()` across 6 distinct injection points:</p> <p>**filter_engine.py:477** (string equality — default branch): ```python expression = &#34;{}-&gt;&gt;&#39;{}&#39; {} &#39;{}&#39;&#34;.format(jsonb_column, key, POSTGRES_OP_MAP[oper], value) ```</p> <p>**filter_engine.py:442** (wildcard/LIKE branch): ```python expression = &#34;{}-&gt;&gt;&#39;{}&#39; LIKE &#39;{}&#39; &#34;.format(jsonb_column, key, value.replace(&#39;*&#39;, &#39;%&#39;)) ```</p> <p>**filter_engine.py:456** (boolean branch — value unquoted): ```python expression = &#34;({}-&gt;&gt;&#39;{}&#39; )::boolean {} {}&#34;.format(jsonb_column, key, POSTGRES_OP_MAP[oper], value) ```</p> <p>**filter_engine.py:462** (numeric branch — value unquoted): ```python expression = &#34;({}-&gt;&gt;&#39;{}&#39; )::float {} {}&#34;.format(jsonb_column, key, POSTGRES_OP_MAP[o…</p> https://cve.radiocsirt.org/vuln/ghsa-6j7p-qjhg-9947