AIKIDO-2026-457267

TL;DR

When an explore or metric query is compiled, user-attribute values including the intrinsic email attribute and embed-JWT-supplied attributes are substituted into the warehouse SQL string. The helper that wraps these values in the warehouse quote character never escapes them, unlike the parameter path which routes equivalent values through the warehouse escapeString function. A low-privilege authenticated user or an embed viewer can supply a value containing a quote to break out of the string literal and inject SQL that runs against the warehouse under the project's credentials, bypassing row-level security and enabling cross-tenant data exfiltration. The fix escapes user-attribute and intrinsic values with the warehouse escape function and allow-lists identifier-context substitutions.