CVE-2022-39362

Metabase vulnerable to arbitrary SQL execution from queryhash

HIGH

8.8

CVSS Score

Published: October 26, 2022 at 12:00 AM UTC

Updated: June 17, 2026 at 04:58 AM UTC

1 product affected across 1 vendorMetabase

Using metabase by metabase?

Get instant alerts when new vulnerabilities affect metabase - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, unsaved SQL queries are auto-executed, which could pose a possible attack vector. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer automatically executes ad-hoc native queries. Now the native editor shows the query and gives the user the option to manually run the query if they want.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Metabase · Metabasecontainer

95%

v < 0.41.9v < 0.42.6v < 0.43.7v < 0.44.5v < 1.41.9v < 1.42.6v < 1.43.7v < 1.44.50.41.0 ≤ v < 0.41.90.42.0 ≤ v < 0.42.60.43.0 ≤ v < 0.43.70.44.0 ≤ v < 0.44.51.41.0 ≤ v < 1.41.91.42.0 ≤ v < 1.42.61.43.0 ≤ v < 1.43.71.44.0 ≤ v < 1.44.5

Affected range stops below 0.41.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.42.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.43.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 0.44.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.41.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.42.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.43.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.44.5, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c

References (2)

PatchThird Party Advisory

Source: [email protected]

https://github.com/metabase/metabase/commit/b7c6bb905a9187347cfc9035443b514713027a5c

Third Party Advisory

Source: [email protected]

https://github.com/metabase/metabase/security/advisories/GHSA-93wj-fgjg-r238

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHGitHub_M

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-356NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card