Threat database

Erupt versions up to and including 2.3.0 contain an HQL injection vulnerability in the linkTreeVal parameter of the POST /erupt-api/data/table/{erupt} endpoint. Authenticated users with query permissions can exploit this to bypass tree-scoped data filters by injecting unescaped quotes, allowing them to append always-true OR clauses or boolean subqueries. This enables unauthorized reading of data from other mapped entities.

CVE-2026-4594 is a SQL injection vulnerability in the erupt open-source framework versions up to 1.13.3. It affects the geneEruptHqlOrderBy function in the erupt-jpa module, where the sort.field argument is improperly sanitized, allowing remote attackers to inject malicious SQL via Hibernate queries. No authentication or user interaction is required to exploit this vulnerability. Although the vendor was notified, no response or patch has been issued, and public exploit details are available. The CVSS 4.0 score is 6.9 (medium severity), reflecting the potential for data exposure and integrity compromise but with limited scope and no privilege escalation.

A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai/call/impl/EruptDataQuery.java of the component MCP Tool Interface. This manipulation causes sql injection hibernate. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.