CVE-2026-63489

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.

• CWE-943

• https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6
• https://github.com/yeti-platform/yeti/pull/1277
• https://github.com/yeti-platform/yeti/releases/tag/2.5.1
• https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63475isomorphic-git is a pure JavaScript implementation of Git fo…4.3
• CVE-2026-63476isomorphic-git is a pure JavaScript implementation of Git fo…4.3
• CVE-2026-63478isomorphic-git is a pure JavaScript implementation of Git fo…5.3
• CVE-2026-6348WinMatrix agent developed by Simopro Technology has a Missin…8.8
• CVE-2026-63481Hurl is a command line tool that runs and tests HTTP request…6.9
• CVE-2026-63482Yeti bridges the gap between CTI and DFIR practitioners by p…7.5
• CVE-2026-6349The  iSherlock developed by HGiga  has an OS Command Injecti…9.8
• CVE-2026-63490Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-63492Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63493Snipe-IT is an IT asset/license management system. Prior to …8.1
• CVE-2026-63494Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63495Libevent is an event notification library. From 2.2.0-alpha-…7.5