CVE-2023-24812

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the `api/notes/search-by-tag` endpoint.

• CWE-89
• CWE-89

• https://github.com/misskey-dev/misskey/commit/ee74df68233adcd5b167258c621565f97c3b2306Patch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-cgwp-vmr4-wx4qVendor Advisory
• https://github.com/misskey-dev/misskey/commit/ee74df68233adcd5b167258c621565f97c3b2306Patch
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-cgwp-vmr4-wx4qVendor Advisory

Published

Feb 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24807Undici is an HTTP/1.1 client for Node.js. Prior to version 5…7.5
• CVE-2023-24808 PDFio is a C library for reading and writing PDF files. In …6.5
• CVE-2023-24809NetHack is a single player dungeon exploration game. Startin…5.5
• CVE-2023-2481 Compiler removal of buffer clearing in sli_se_opaque_im…7.5
• CVE-2023-24810Misskey is an open source, decentralized social media platfo…6.1
• CVE-2023-24811Misskey is an open source, decentralized social media platfo…6.1
• CVE-2023-24813Dompdf is an HTML to PDF converter written in php. Due to th…9.8
• CVE-2023-24814TYPO3 is a free and open source Content Management Framework…6.1
• CVE-2023-24815Vert.x-Web is a set of building blocks for building web appl…5.3
• CVE-2023-24816IPython (Interactive Python) is a command shell for interact…7
• CVE-2023-24817RIOT-OS, an operating system for Internet of Things (IoT) de…7.5
• CVE-2023-24818RIOT-OS, an operating system that supports Internet of Thing…7.5