Live › vulnerability › CVE-2026-111634
Go to dashboardHelical Insight through 7.0.0 builds report SQL by pasting request parameter values into placeholders; the SqlDetect guard checks the wrong JSON key and never runs. Any logged-in viewer can call /executeDatasource to read other tables and modify data in the report's data source. No vendor fix is published yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Helical Insight up to and including 7.0.0 where users have viewer access to reports that use Numeric or String placeholders. Installations without authenticated viewer accounts exposed to untrusted users have a smaller exposure. The sources do not name a patched version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| helicalinsight | vendor | <= 7.0.0 | – |
7.0.0 is affected)7.0.0 is the latest releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
This page as .md · .json · in your agent: get_signal("CVE-2026-111634")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.