Threats affecting pkg:github/flowintel/flowintel

CVE-2026-124850 is a SQL injection vulnerability in a database migration script of flowintel versions prior to 4.0.0. The migration process interpolates stored connector identifier values directly into SQL statements without parameterization, allowing an attacker with prior write access to the database to execute arbitrary SQL during an upgrade. This can lead to unauthorized data disclosure, modification, or deletion.

CVE-2026-0000 is a SQL injection vulnerability in a database migration script of flowintel versions prior to 4.0.0. The migration process interpolates stored connector identifier values directly into SQL statements without parameterization, allowing an attacker with prior write access to the database to execute arbitrary SQL during an upgrade. This can lead to unauthorized data disclosure, modification, or deletion.