CVE-2024-9264
Grafana SQL Expressions allow for remote code execution
CRITICAL 9.4EPSS 97.1%
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
- Affected
- Grafana
- CVSS v4.0 GRAFANA
- 9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 NVD
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 GRAFANA
- 9.9 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 97.14% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- critical · CWE-94
- Published
- 2024-10-18
- Updated
- 2025-03-14
Proof-of-concept exploits (12)
- 14mb1v45h/cyberspace0610★ · 2024-10-30
- Cythonic1/CVE-2024-92643★ · 2025-06-05
- Royall-Researchers/CVE-2024-92640★ · 2025-07-05
- nollium/CVE-2024-9264132★ · 2024-12-16
- patrickpichler/grafana-CVE-2024-92640★ · 2025-07-21
- ruizii/CVE-2024-92640★ · 2025-07-05
- rvizx/CVE-2024-92642★ · 2025-07-07
- z3k0sec/CVE-2024-9264-RCE-Exploit38★ · 2024-10-21
- z3k0sec/File-Read-CVE-2024-92648★ · 2024-10-20
- ozcanpng/CVE-2024-92640★ · 2026-07-22
- rvzsec/CVE-2024-92642★ · 2025-07-07
- yeonchoda/CVE-2024-92640★ · 2026-06-29