[Security] DDL SQL Injection via quoteDefault() — ALL 6 DB backends (CWE-89)
Author: TuanHung1149Created Jul 31, 2026Updated Jul 31, 2026
Security Vulnerability Report
Discovered by: SuyZ (UIT — University of Information Technology, Ho Chi Minh City)
I've discovered a SQL injection in the Console's DDL generation. quoteDefault() wraps values in single quotes WITHOUT escaping. sqlEscapeText() EXISTS but is NOT used. Affects ALL 6 DB backends (PostgreSQL, MSSQL, MySQL, CockroachDB, Citus, AlloyDB).
File: frontend/libs/console/legacy-ce/src/lib/components/Services/Data/utils.js:94-99
CWE-89 | 11/11 PoC vectors PASS across all 6 DB backends
Per SECURITY.md, I will send the full report with PoC to [email protected].
Source: hasura/graphql-engine