CVE-2024-9264

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

• CWE-94
• CWE-77

• https://grafana.com/security/security-advisories/cve-2024-9264/Vendor Advisory
• https://security.netapp.com/advisory/ntap-20250314-0007/

Published

Oct 18, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9258IrfanView SID File Parsing Uninitialized Pointer Remote Code…7.8
• CVE-2024-9259IrfanView SID File Parsing Out-Of-Bounds Write Remote Code E…7.8
• CVE-2024-9260IrfanView SID File Parsing Out-Of-Bounds Write Remote Code E…7.8
• CVE-2024-9261IrfanView SID File Parsing Stack-based Buffer Overflow Remot…7.8
• CVE-2024-9262The User Meta – User Profile Builder and User management plu…6.5
• CVE-2024-9263The WP Timetics- AI-powered Appointment Booking Calendar and…9.8
• CVE-2024-9265The Echo RSS Feed Post Generator plugin for WordPress is vul…9.8
• CVE-2024-9266URL Redirection to Untrusted Site ('Open Redirect') vulnerab…4.7
• CVE-2024-9267The Easy WordPress Subscribe – Optin Hound plugin for WordPr…6.1
• CVE-2024-9268Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-9269The Relogo plugin for WordPress is vulnerable to Stored Cros…6.4
• CVE-2024-9270The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is …6.4