---
id: "CVE-2026-63489"
kind: "vulnerability"
aliases: ["CVE-2026-63489"]
title: "Yeti: low-privileged users can inject ArangoDB queries through search endpoints"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "yeti", "fixed": ["2.5.1"], "affected": "<= 2.5.0", "ecosystem": "github"}]
ecosystems: []
tags: ["arangodb", "dfir", "package", "self-hosted", "threat-intel", "yeti"]
not_affected_if: ["no-user-accounts-exposed", "version-above-2.5.0"]
published_at: "2026-11-03T20:18:16+00:00"
first_seen_at: "2026-11-03T20:49:23+00:00"
updated_at: "2026-11-03T21:02:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63489", "first_seen_at": "2026-11-03T20:49:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:02:16+00:00"}]
---

# Yeti: low-privileged users can inject ArangoDB queries through search endpoints

Yeti, a forensics intelligence platform, builds ArangoDB search queries from user-supplied sort fields and filter paths without sanitizing them. An authenticated low-privileged user can read internal collections such as users, probe the schema, and exhaust database resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:yeti affected <= 2.5.0 fixed 2.5.1

## How to check

- Check the installed Yeti version: 2.5.0 and earlier are affected; 2.5.1 contains the fix.
- Any authenticated account, including non-admin, can reach POST /api/v2/observables/search, /entities/search, /indicators/search, /dfiq/search, /search/ and /graph/search, which accept the vulnerable 'sorting' and 'filter_aliases' fields.
- In core/database_arango.py, unvalidated interpolation like f"o.{field}" in sorting and filter_aliases means the old code is present.

## Fix

Upgrade Yeti to 2.5.1 or later (release notes: fix: prevent AQL injection via sorting and filter_aliases parameters, PR #1277).

## Timeline

- 2026-11-03T20:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63489
- 2026-11-03T21:02:16+00:00 analyst — Vendor advisory GHSA-vw33-fwfx-6m9p: <=2.5.0 affected; 2.5.1 release notes list 'prevent AQL injection via sorting and filter_aliases parameters' (PR 1277). Triage's 'no fix' was stale. No public exploitation seen; PoC curl in advisory.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p
- [fix] Patch: github.com https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6
- [fix] Release notes: github.com https://github.com/yeti-platform/yeti/releases/tag/2.5.1

## From the sources

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_