Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck
CVE-2026-111634Helical Insight through 7.0.0 SQL Injection via /executeDatasource
High 8.1
In plain English
A high-severity SQL injection in helicalinsight from helicalinsight. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 73.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| helicalinsight | helicalinsight | 0 – through 7.0.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli third-party-advisory
- https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/datasource/EfwdQueryProcessor.java#L220-L235 technical-description
- VulnCheck Advisory: Helical Insight through 7.0.0 SQL Injection via /executeDatasource third-party-advisory