AIKIDO-2026-10047

TL;DR

Affected versions of this package are vulnerable to SQL injection because user-controlled query criteria could be passed into the internal query builder without sufficient validation, allowing untrusted input to influence the structure of generated SQL queries. In Craft CMS, this meant that parameters such as filtering or ordering options could be merged into SQL fragments rather than being strictly constrained or safely parameterized, enabling an attacker to inject crafted SQL and alter query behavior. The referenced commit fixes this by disallowing unsafe criteria and ensuring only explicitly permitted parameters are used when building database queries, preventing SQL manipulation.