Go| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|
| github.com/layer5io/meshery | go | < 0.7.22 | 0.7.22 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized user-controlled input (sort/order parameters) being directly used in SQL queries. The commit diff shows the addition of SanitizeOrderInput to these functions, confirming they previously lacked input validation. Security advisories explicitly link these endpoints (via events_streamer.go and events_persister.go) to the SQL injection vulnerability. Both functions constructed ORDER BY clauses with raw user input, enabling attackers to inject arbitrary SQL commands.
KEV Misses 88% of Exploited CVEs- Get the report
