Kestra v1.3.3 and prior versions are vulnerable to SQL Injection because user-controlled input from a GET parameter is concatenated directly into an SQL query without proper sanitization or parameterization. This allows an attacker to inject arbitrary SQL expressions, potentially compromising the database integrity or confidentiality. No CVSS score or vendor advisory is available, and no patch or remediation level has been confirmed.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or other database-related impacts. The exact impact depends on the database privileges and application context but generally represents a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or web application firewall rules to block malicious SQL input patterns as a temporary mitigation.