CVE-2026-12206 is a SQL injection vulnerability affecting Grit42 Grit up to version 0.11.0. The issue resides in the Grit::Assays::DataTableEntity function within the file modules/assays/backend/app/models/grit/assays/data_table_entity.rb. Remote attackers can exploit this vulnerability by manipulating input to inject SQL commands, potentially leading to unauthorized database access or modification. Although an exploit is publicly available, there is no vendor response or official fix at this time.

Successful exploitation of this vulnerability can allow remote attackers to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other impacts depending on the database privileges. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation and query parameterization where possible. Monitor for updates from the vendor or trusted security sources for an official patch or workaround.