-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided patch 013a928461e70f38a33258bd525a351ed828e974 clearly indicates a SQL injection vulnerability in the parsl.monitoring.visualization component. The root cause is the use of unsafe Python string formatting (the % operator) to construct SQL queries with user-supplied input (workflow_id) taken directly from URL routes. The patch remediates this by replacing the string formatting with parameterized queries using sqlalchemy.text and a params dictionary. Two functions were identified as vulnerable: workflow_dag_details and workflow_resources in parsl/monitoring/visualization/views.py. Both functions took the workflow_id and inserted it directly into a SQL query string, allowing an attacker to execute arbitrary SQL commands by crafting a malicious URL. This could lead to data exfiltration from the monitoring database or a denial of service.
workflow_dag_detailsparsl/monitoring/visualization/views.py
workflow_resourcesparsl/monitoring/visualization/views.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parsl | pip | < 2026.01.05 | 2026.01.05 |