CVE-2026-111866: SQL Injection in nemoTyrant manong

This vulnerability involves an SQL injection flaw in the cache/del_cache/arr2sql function within func.php of nemoTyrant manong, up to commit 7c9e5228e133b9267ad3a415833bc9bb53193bb4. The flaw allows remote attackers to inject malicious SQL commands due to improper input handling. The product's rolling release model complicates precise version identification. Although the related GitHub issue was closed with a 'completed' status, the exact fix commit or pull request is not identified, leaving patch availability unclear.

Successful exploitation of this SQL injection vulnerability could allow remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data disclosure, modification, or deletion. The CVSS 4.0 base score of 6.9 indicates a medium severity impact with network attack vector and no privileges or user interaction required. However, the lack of confirmed exploit activity in the wild reduces immediate risk.

Patch status is not yet confirmed — check the vendor advisory or official repository for current remediation guidance. Since the GitHub issue was closed as completed, it is recommended to monitor the official nemoTyrant project for updates or commits addressing this vulnerability. Until a fix is confirmed, consider restricting access to vulnerable endpoints or applying input validation controls if feasible.