{"id":"CVE-2026-63489","kind":"vulnerability","aliases":["CVE-2026-63489"],"related":[],"title":"Yeti: low-privileged users can inject ArangoDB queries through search endpoints","description":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.","summary":"Yeti, a forensics intelligence platform, builds ArangoDB search queries from user-supplied sort fields and filter paths without sanitizing them. An authenticated low-privileged user can read internal collections such as users, probe the schema, and exhaust database resources.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"yeti","fixed":["2.5.1"],"affected":"<= 2.5.0","ecosystem":"github"}],"ecosystems":[],"tags":["arangodb","dfir","package","self-hosted","threat-intel","yeti"],"not_affected_if":["no-user-accounts-exposed","version-above-2.5.0"],"how_to_check":"- Check the installed Yeti version: 2.5.0 and earlier are affected; 2.5.1 contains the fix.\n- Any authenticated account, including non-admin, can reach POST /api/v2/observables/search, /entities/search, /indicators/search, /dfiq/search, /search/ and /graph/search, which accept the vulnerable 'sorting' and 'filter_aliases' fields.\n- In core/database_arango.py, unvalidated interpolation like f\"o.{field}\" in sorting and filter_aliases means the old code is present.","fix":"Upgrade Yeti to 2.5.1 or later (release notes: fix: prevent AQL injection via sorting and filter_aliases parameters, PR #1277).","status":"open","published_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","triaged_at":"2026-11-03T20:50:05+00:00","updated_at":"2026-11-03T21:02:16+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-03T20:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Yeti: low-privileged users can inject ArangoDB queries through search endpoints","impact":"medium","summary":"Yeti, a forensics intelligence platform, builds ArangoDB search queries from user-supplied sort fields and filter paths without sanitizing them. An authenticated low-privileged user can read internal collections such as users, probe the schema, and exhaust database resources.","audience":"businesses","category":"package","nicknames":[],"who_cares":["yeti","self-hosted","arangodb","dfir","threat-intel"],"confidence":0.7,"fix_status":"none","needs_auth":"yes","worst_case":"Attacker reads internal database collections and degrades database performance","analyst_note":"Check the vendor advisory and release notes linked from the NVD entry for any fixed version or workaround; sources here say none yet.","how_to_check":"- Check the installed Yeti version against the affected range: `2.5.0` and earlier are affected per the description.\n- Look at `core/database_arango.py` in the deployed code to confirm the vulnerable interpolation is present.\n- Note whether the search endpoints (`/api/v2/observables/search`, `/api/v2/entities/search`, `/api/v2/indicators/search`, `/api/v2/dfiq/search`, `/api/v2/search/`, `/api/v2/graph/search`) are reachable by ordinary user accounts.","plain_action":"","needs_analyst":true,"not_affected_if":["no-user-accounts-exposed","version-above-2.5.0"],"who_is_affected":"Teams that run a self-hosted Yeti instance where any user account, including low-privileged ones, can reach the search API. The sources say no fixed version exists as of this review. Instances where only trusted administrators hold accounts face less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000771,"input_tokens":4406,"output_tokens":660,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor advisory and release notes linked from the NVD entry for any fixed version or workaround; sources here say none yet.","search":"'-2026':14A,17A '-63489':15A,18A '/api/v2/dfiq/search':133C '/api/v2/entities/search':129C '/api/v2/graph/search':138C '/api/v2/indicators/search':131C '/api/v2/observables/search':127C '/api/v2/search':135C '2.5.0':90C 'alias':103C 'alter':164C 'aql':108C,143C 'arangodb':8A,20B,36B,107C 'arbitrari':186C 'attack':141C 'attacker-control':140C 'attribut':104C 'authent':52B,119C 'avail':196C 'bridg':72C 'build':35B 'caus':139C 'collect':60B,160C 'consum':172C 'context':184C 'control':98C,142C 'core/database_arango.py':114C 'craft':123C 'cti':76C 'cve':13A,16A 'databas':69B,174C,187C 'dfir':21B,78C 'direct':94C 'earlier':92C 'endpoint':12A 'enumer':168C 'error':154C 'establish':191C 'evalu':149C,156C 'excess':173C 'exhaust':68B 'express':111C,157C 'field':44B,100C 'filter':46B,102C 'fix':193C 'forens':32B,83C 'gap':74C 'host':25B 'identifi':109C 'inform':170C 'inject':7A,178C 'intel':28B 'intellig':33B,84C 'intend':165C 'intern':59B,159C 'interpol':95C 'logic':167C 'low':3A,54B,117C 'low-privileg':2A,53B,116C 'oracl':155C 'packag':22B 'pars':147C 'path':47B,105C 'pipelin':87C 'platform':34B,85C 'point':179C 'posit':112C 'post':126C,128C,130C,132C,134C,137C 'practition':79C 'privileg':4A,55B,118C 'probe':64B 'provid':81C,152C 'queri':9A,38B 'read':58B,181C 'resourc':70B,175C 'review':200C 'sanit':49B 'schema':66B,169C 'search':11A,37B,166C,183C 'self':24B 'self-host':23B 'send':122C 'sort':43B,99C 'subexpress':144C 'suppli':42B 'threat':27B 'threat-intel':26B 'user':5A,41B,56B,63B,97C,120C,163C 'user-control':96C 'user-suppli':40B 'valu':124C 'verifi':177C 'version':89C,194C 'without':48B 'write':188C 'yeti':1A,19A,29B,30B,71C,93C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Yeti version 2.5.0 or earlier where more than fully trusted people hold accounts. Any logged-in user, even non-admin, can send crafted sorting or filter_aliases values to the search API to run database expressions, read internal collections such as users, and cause heavy queries. The advisory says arbitrary writes are not established. Instances on 2.5.1 or later, or with no untrusted accounts, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","run_id":1561},"products":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","run_id":1561},"how_to_check":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","run_id":1561},"who_affected":{"at":"2026-11-03T21:02:16Z","by":"analyst","doc":"https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","run_id":1561}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["yeti"],"ptokens":["yeti"],"labels":["arangodb","dfir","high","package","selfhosted","threatintel","yeti"],"campaign_type":null,"first_public_at":"2026-07-01T12:26:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63489","severity":null,"published_at":"2026-11-03T20:18:16+00:00","modified_at":"2026-11-03T20:18:16+00:00","first_seen_at":"2026-11-03T20:49:23+00:00","fetched_at":"2026-11-03T20:49:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63489:1561","url":null,"severity":null,"published_at":"2026-11-03T21:02:16+00:00","modified_at":"2026-11-03T21:02:16+00:00","first_seen_at":"2026-11-03T21:02:16+00:00","fetched_at":"2026-11-03T21:02:16+00:00","note":"Vendor advisory GHSA-vw33-fwfx-6m9p: <=2.5.0 affected; 2.5.1 release notes list 'prevent AQL injection via sorting and filter_aliases parameters' (PR 1277). Triage's 'no fix' was stale. No public exploitation seen; PoC curl in advisory."}],"documents":[{"id":60610,"url":"https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":60608,"url":"https://github.com/yeti-platform/yeti/releases/tag/2.5.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":60612,"url":"https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T12:26:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}