Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/openmeterio/openmeter

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3GoPublished

    OpenMeter: SQL injection through meter creation

    CVE-2026-8462 · GHSA-wc3v-3457-c8cm

    Affected
    • Go github.com/openmeterio/openmeter < 1.0.0-beta.228
    Fixed in
    1.0.0-beta.228· Vendor fix available
    Issue
    An authenticated tenant can inject arbitrary SQL through the valueProperty or groupBy fields of POST /api/v1/meters. The injection passes the application's JSONPath validation check and executes against the shared ClickHouse database, which contains event data for all tenants with no row-level security. Any authenticated tenant can read or write every other tenant's metering data. Details openmeter/streaming/clickhouse/utilsquery.go:15 builds a ClickHouse SELECT by interpolating user input with fmt.Sprintf: sqlbuilder.Escape() (go-sqlbuilder v1.40.2) only replaces $ → $$ to prevent collisions with the library's own argument placeholders. It does not escape single quotes. A single quote in the input closes the string literal, and subsequent tokens execute as raw SQL. sb.Build() always returns an empty args slice — the query is never parameterized. The payload must be prefixed with a valid JSONPath expression (e.g. $.foo) because ClickHouse raises error code 36 (BADARGUMENTS)…

    Recommended action: Upgrade to 1.0.0-beta.228 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →