CVE-2026-21892
SQL Injection in Parsl-Visualize Enables Data Exfiltration
Publication date: 2026-01-08
Last updated on: 2026-01-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parsl | parsl | to 2026.01.05 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-21892 is a SQL Injection vulnerability in the Parsl Python parallel scripting library, specifically in the parsl-visualize component. The vulnerability occurs because the application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) taken directly from URL routes without sanitization or parameterization. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands. The injected commands can manipulate the database queries, leading to unauthorized data access or disruption of service. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to perform data exfiltration, accessing sensitive information such as environment variables, task parameters, and host information from the monitoring database. Attackers can also bypass access controls by injecting boolean logic to view unauthorized data. Additionally, they can cause denial of service by injecting resource-intensive or time-based queries that crash the visualization server or database. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the parsl-visualize component's URL routes that accept the workflow_id parameter for SQL injection. One approach is to manipulate the workflow_id parameter in the URL with typical SQL injection payloads such as ' OR '1'='1 or UNION SELECT statements and observe the behavior of the visualization dashboard. For example, sending requests to URLs like /visualization/workflow/<workflow_id> with injected payloads and checking if the visualization graph disappears or reappears can indicate a Boolean-based blind SQL injection. Specific commands could include using curl or a web testing tool to send crafted HTTP requests with malicious workflow_id values and monitoring the responses or errors from the server. Example curl command: curl -v "http://<server>/visualization/workflow/' OR '1'='1". Additionally, monitoring logs for unusual SQL errors or unexpected query results can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading to version 2026.01.05 of Parsl, which fixes the vulnerability by replacing unsafe string formatting with parameterized SQL queries using SQLAlchemy. If upgrading is not immediately possible, restrict access to the visualization dashboard to trusted users only, as the vulnerability requires access to this interface. Additionally, monitor and filter incoming requests to detect and block suspicious workflow_id inputs that may contain SQL injection payloads. Applying network-level controls or web application firewalls to limit exposure can also help reduce risk until the patch is applied. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to perform SQL injection attacks that can lead to data exfiltration of sensitive information such as environment variables, task parameters, and host information from the monitoring database. This exposure of sensitive data could potentially violate compliance requirements under standards like GDPR and HIPAA, which mandate protection of personal and sensitive data. Therefore, the vulnerability poses a risk to compliance by enabling unauthorized access and potential leakage of sensitive data. [1]