CVE-2026-33142: OneUptime SQL Injection Vulnerability via Unvalidated Column Identifiers
Summary
CVE-2026-33142: The fix for GHSA-p5g2-jm85-8g35 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same validation to three other query construction pa... Affects oneuptime versions < 10.0.34. Fixed in 10.0.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneUptime is an open-source platform designed for monitoring and managing various aspects of software applications, including analytics for logs, metrics, spans, and exceptions. It leverages ClickHouse for data storage and querying. However, it has been identified that certain query construction methods within OneUptime do not validate user inputs properly, leading to potential SQL injection vulnerabilities.
Vulnerability Detail
The vulnerability arises from the lack of validation for user-controlled column identifiers in the sort, select, and groupBy parameters of SQL queries. Specifically, the methods toSortStatement, toSelectStatement, and toGroupByStatement in the StatementGenerator class do not check if the provided keys correspond to actual model columns. This oversight allows an authenticated user to inject arbitrary SQL commands, potentially leading to unauthorized access, modification, or deletion of sensitive analytics data stored in ClickHouse. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
How To Fix
Latest published version: 4.0.69 as of 23 Oct 2026
npm install oneuptime@4.0.69Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.34
This is the first release that contains the fix.
npm install oneuptime@10.0.34Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation on the client side to ensure that only valid column names are sent in the sort, select, and groupBy parameters. However, this is not a substitute for proper server-side validation.
Conclusion
The SQL injection vulnerability in OneUptime, identified as CVE-2026-33142, poses significant risks to applications using this package. By updating to the patched version and implementing proper validation checks, users can mitigate these risks effectively.
See every vulnerability recorded for oneuptime →
FAQ
CVE-2026-33142 is a vulnerability in the OneUptime package that allows SQL injection through unvalidated column identifiers in certain query parameters.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any signup.
An attacker could exploit this vulnerability to inject arbitrary SQL, potentially allowing them to read, modify, or delete sensitive analytics data.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Update the OneUptime package to version 10.0.34 or later and ensure proper validation of user inputs in SQL queries.
References
Related vulnerabilities
Recent vulnerabilities recorded for oneuptime.
