AIKIDO-2026-859495

datacontract-cli is vulnerable to SQL Injection

SQL Injection Pre-CVE Published 3 days ago

Medium Risk

This Affects:

datacontract-cli

0.10.14 - 1.1.1

Fixed in 1.1.2

Are you affected? Scan for Free

TL;DR

A data contract can define a quality.type: sql rule whose query is executed against the configured data source when the contract is tested. Before the fix, that query is run as written, so a contract from an untrusted source can execute write statements and DuckDB COPY or ATTACH operations instead of a read-only check. This lets the contract modify data and read or write local files through the database engine rather than only validating data quality. The fix requires such rules to be read-only and reports DDL, DML, COPY, and ATTACH statements as a failed check for every data source.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run datacontract test on a data contract from an untrusted source that defines a quality.type: sql rule against a configured data source.