CVE-2026-111634: Helical Insight through 7.0.0 SQL Injection via /executeDatasource
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated account with viewer-level access. They must be able to submit crafted Numeric or String report parameter values to the /executeDatasource endpoint.
What is the potential impact on the underlying database?
Successful exploitation can allow reading tables that are not exposed by the report and modifying data in the report's configured data source. The reported impact does not include availability effects.
Are normal report parameter types affected?
Both Numeric and String placeholder values are affected when they are passed unescaped to /executeDatasource. The SqlDetect guard can be bypassed for crafted values.
How can I determine whether my deployment is in scope?
Deployments of Helical Insight through version 7.0.0 are affected according to the available information. Review whether authenticated viewers can invoke /executeDatasource with report parameters backed by a database data source.