Threats affecting pkg:github/gcpaas/DataRoom

CVE-2026-125381 is an SQL injection vulnerability in gcpaas DataRoom versions up to 3.0.0. It occurs in the MyBatisService.generateSql function, allowing users with sharer-role permissions to inject SQL commands by crafting dataset parameters. This can be exploited by sending specially crafted inputParam values to the /dataRoom/dataset/run endpoint, leveraging unquoted string parameters or MySQL backslash escapes to execute arbitrary SQL against the database.

DataRoom versions up to 3.0.0 have an incorrect authorization vulnerability in the DatasetController.runTest function. This flaw allows users with visitor-role privileges to execute arbitrary dataset definitions, including specifying any dataSourceCode and raw SELECT SQL queries. As a result, attackers can query any configured relational data source using stored decrypted credentials, bypassing developer-only access restrictions.