GHSA-gcg3-c5p2-cqgg
High · 8.1CVSS
8.1
EPSS
—
Published
Mar 18, 2026
CISA due date
—
The record
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | oneuptime | 0 | 10.0.34 |
Related vulnerabilities
- CVE-2026-33142 OneUptime is a solution for monitoring and managing online services. Same vulnerability
- CVE-2026-33143 OneUptime is a solution for monitoring and managing online services. Also affects oneuptime
- GHSA-g5ph-f57v-mwjc OneUptime WhatsApp Webhook Missing Signature Verification Also affects oneuptime
- GHSA-4524-cj9j-g4fj OneUptime: Password Reset Token Logged at INFO Level Also affects oneuptime
- GHSA-wvh5-6vjm-23qh OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") Also affects oneuptime
- GHSA-p5g2-jm85-8g35 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters Also affects oneuptime
- CVE-2026-32598 OneUptime is a solution for monitoring and managing online services. Also affects oneuptime
- CVE-2026-32308 OneUptime is a solution for monitoring and managing online services. Also affects oneuptime