CVE-2026-115331

{
  "etk_id": "ETK-2026-2445",
  "cve_id": "CVE-2026-115331",
  "display_id": "CVE-2026-115331",
  "ghsa_id": "GHSA-v5rh-mv3x-53gj",
  "euvd_id": "EUVD-2026-108133",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Lotus metric query generation",
  "summary": "Lotus through version 0.10.2 is affected by SQL injection when generating queries for billable metrics. An authenticated organization user who can provide metric property names or categorical filter values may cause unintended database queries, potentially affecting data shared across tenants.",
  "mitigation": "Restrict creation and editing of billable metrics and categorical filters to trusted users until an updated release is available. Upgrade from versions through 0.10.2 after confirming a vendor-fixed release.",
  "vendor": "uselotus",
  "product": "lotus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.10.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "lotus",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.88301165,
  "t0_at": "2026-10-22T10:57:48.115000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T10:57:48.115000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T10:57:48.115000+00:00",
      "url": "https://github.com/advisories/GHSA-v5rh-mv3x-53gj"
    }
  }
}