GHSA-p5g2-jm85-8g35
Critical · 9.9CVSS
9.9
EPSS
—
Published
Mar 13, 2026
CISA due date
—
The record
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | oneuptime | 0 | 10.0.23 |
Related vulnerabilities
- CVE-2026-32306 OneUptime is a solution for monitoring and managing online services. Same vulnerability
- CVE-2026-33142 OneUptime is a solution for monitoring and managing online services. Also affects oneuptime
- CVE-2026-33143 OneUptime is a solution for monitoring and managing online services. Also affects oneuptime
- GHSA-g5ph-f57v-mwjc OneUptime WhatsApp Webhook Missing Signature Verification Also affects oneuptime
- GHSA-gcg3-c5p2-cqgg OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in… Also affects oneuptime
- GHSA-4524-cj9j-g4fj OneUptime: Password Reset Token Logged at INFO Level Also affects oneuptime
- GHSA-wvh5-6vjm-23qh OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") Also affects oneuptime
- CVE-2026-32598 OneUptime is a solution for monitoring and managing online services. Also affects oneuptime