Threats affecting pkg:github/flowintel

CVE-2026-124850 is a SQL injection vulnerability in a database migration script of flowintel versions prior to 4.0.0. The migration process interpolates stored connector identifier values directly into SQL statements without parameterization. An attacker with prior write access to the database can plant malicious identifier values that trigger arbitrary SQL execution during an upgrade. This can lead to unauthorized data disclosure, modification, or deletion.