ETK-2026-84Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-84",
  "cve_id": null,
  "display_id": "ETK-2026-84",
  "ghsa_id": "GHSA-p37g-cjqx-56hq",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "SQL injection in aisoc-actions osquery query templates",
  "summary": "aisoc-actions versions before 12.3.1 build osquery queries from action parameters without sufficient type enforcement. An attacker able to author playbooks or dispatch actions can make managed endpoints run altered queries and expose endpoint-accessible data under the agent's privileges.",
  "mitigation": "Upgrade aisoc-actions to version 12.3.1 or later. Until all deployments are updated, limit playbook authoring and action-dispatch access to trusted administrators.",
  "vendor": "pip",
  "product": "pip:aisoc-actions",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 12.3.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "12.3.1"
      ],
      "package_name": "aisoc-actions",
      "purl": "pkg:pypi/aisoc-actions"
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 13.284504633333333,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-09-30T06:03:46.115761+00:00",
      "days": -20.961618953229166,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:08:30.016377+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-29T19:36:58+00:00",
      "days": -21.396898070833334,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T05:08:30.016377+00:00",
      "url": "https://github.com/beenuar/AiSOC/security/advisories/GHSA-p37g-cjqx-56hq"
    }
  }
}