CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint

Sun, 14 Jun 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-12188%20-%20grit42%20-%20SQL%20Injection%20in%20CSV%20Export%20Endpoint
📋 CVE record: CVE-2026-12188

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	grit - Open-source scientific research data management platform built by grit42 A/S. The platform stores and visualises data from pre-clinical drug discovery workflows: compounds, batches, assay models, experiment results, and dynamically-typed data tables.
Affected Version	0.0.x through 0.11.0 (every public release; sink introduced in initial commit `79b9dfa`)
Endpoint	`GET /api/grit/<engine>/<resource>/export` (any resource declared with `resources_with_export`)
Vulnerability Type	CWE-89: SQL Injection
CVE ID	CVE-2026-12188

Vulnerability Summary

The CSV export action in grit’s GritEntityController splats the user-controlled params[:columns] into Model.unscoped.select(*params[:columns]), then wraps the resulting relation in a PostgreSQL COPY (...) TO STDOUT WITH CSV HEADER statement. Rails’ select accepts raw SQL fragments, so any authenticated user can inject sub-selects into the SELECT clause and exfiltrate any column the database role can see.

Grit42 on Natan Maia Morette

CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint

Advisory Information

Vulnerability Summary