AIKIDO-2025-10656

inspector-apm/neuron-ai is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Pre-CVE

High Risk

This Affects:

inspector-apm/neuron-ai

1.11.4 - 2.2.9

Fixed in 2.2.10

TL;DR

Affected versions of this package are vulnerable to SQL Injection due to improper neutralization of prompt elements in the database query tool. The old code directly concatenated user-supplied input into SQL queries without using parameterized statements when handling the prompt, allowing attackers to execute arbitrary SQL commands on the underlying database. The patched code enforces the use of named placeholders and parameter binding, effectively neutralizing this threat by separating SQL code from data.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

inspector-apm/neuron-ai is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 1.11.4 - 2.2.9.