Threats tagged 'ghsa-3w4f-3q27-257j'

Nango versions prior to 0.71.3 contain an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by submitting a specially crafted task group key to the orchestrator API. This occurs via the POST /v1/immediate endpoint, where the input is interpolated unsafely into a Postgres NOTIFY statement, enabling stacked queries against the scheduler database.