DIRAC · GHSA-7xw9-549r-8jrc · Package
FIX → 9.1.10 · 8.0.79 +1
DIRAC's PilotManager service passes caller-supplied parameters straight into SQL statements without escaping, enabling SQL injection. Its access control only requires authentication, so any logged-in user can manage pilot jobs, including deleting them and reading their output.
first public Jul 13, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run DIRAC's workload management PilotManager service and let authenticated users reach it. The flaw sits in the service's database calls and its access rules, so deployments that do not expose the service to other users are less exposed. The sources do not say which configurations are not affected.
Not affected if service-not-deployed
Who cares dirac, grid-computing, pypi, self-hosted
pip show DIRACUpgrade to 9.1.10 · 8.0.79 +1
A number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus: https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349
This won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries.
Further to this, the PilotManager access control is only set to "authenticated"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job: https://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118
This is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions.
https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.0.79 for the 6.x to 8.0.x line9.0.22 for the 8.1.x to 9.0.x line9.1.10 for the 9.1.x lineThis page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.