AIKIDO-2026-11116
@lightdash/common is vulnerable to SQL Injection
81
High Risk
This Affects:
@lightdash/commonTL;DR
The @lightdash/common Liquid SQL templating renders parameter values directly into warehouse SQL output tags. String parameter values are not escaped before interpolation, so a value containing a single quote can break out of a SQL string literal and inject arbitrary SQL. An authenticated user who controls parameter values can bypass query filters and read or manipulate data beyond the intended query. The fix passes the warehouse SQL builder escape function into the Liquid renderer so string parameter values are escaped before they reach the SQL output.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@lightdash/common is vulnerable to SQL Injection in versions 0.2570.0 - 0.3111.0.
How to fix this
Upgrade the @lightdash/common library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant