Patchfirst
Patchfirst
CVE-2024-9264 Public exploit Critical · 9.9 EPSS 97.6%

Grafana SQL Expressions allow for remote code execution

Grafana · Grafana

Summary

The SQL Expressions experimental feature in Grafana, which evaluates DuckDB queries built from user input, fails to sanitise that input before passing it to DuckDB, enabling command injection and local file inclusion. An attacker with at least VIEWER permission on the network can exploit it without user interaction, provided the duckdb binary is present in Grafana's $PATH, which is not the default for Grafana distributions.

Official description · CVE.org

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Breakdown
32.6 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (Metasploit) was available 1 day before disclosure.

  1. Public exploit codeMetasploit1 day before
  2. Disclosedday 0

7 fixes in github.com/grafana/grafana over 21 months. The latest fix listed for github.com/grafana/grafana is 12.2.2.

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 10.3.4CVE-2024-14427 Mar 2024
  2. 10.3.5CVE-2024-131326 Mar 2024
  3. 11.1.3CVE-2024-632220 Aug 2024
  4. 11.2.2+security-01CVE-2024-926418 Oct 2024
  5. 11.4.1CVE-2024-1174131 Jan 2025
  6. 11.6.2CVE-2025-108818 Jun 2025
  7. 12.2.2CVE-2025-4111521 Nov 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/grafana/grafana.

Gogithub.com/grafana/grafanaGHSA-q99m-qcv4-fpm7GO-2024-3215

Upgrade to 11.2.2+security-01

Still affected on this line by CVE-2022-31097 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

Also affected, despite being newer: All versions.

Gogo get github.com/grafana/grafana@v11.2.2+security-01

The first fix for CVE-2024-9264.

Affected versions, by release line

If you runUpgrade to
11.2.0 up to 11.2.2+security-0111.2.2+security-01
11.1.0 up to 11.1.7+security-01

Still affected on this line by CVE-2022-31097 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

11.1.7+security-01
11.0.0 up to 11.0.6+security-01

Still affected on this line by CVE-2022-31097 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

11.0.6+security-01
All versionsNo fix published

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

Other 2

grafana.com/security/security-advisories/cve-2024-9264/security.netapp.com/advisory/ntap-20250314-0007/
↑ ↓ chooseEnter openEsc close