CVE-2026-12188: Grit42 Grit SQL Injection Vulnerability

CVE-2026-12188 Overview

CVE-2026-12188 is a SQL injection vulnerability affecting Grit42 Grit versions up to and including 0.11.0. The flaw resides in the GritEntityController component, specifically within the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb. An authenticated remote attacker can manipulate input parameters to inject arbitrary SQL statements against the backend database. Public exploit details have been disclosed, and the vendor did not respond to coordinated disclosure attempts. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
An authenticated remote attacker can inject SQL through the GritEntityController to read, modify, or exfiltrate data from the application database.

Affected Products

Grit42 Grit versions up to and including 0.11.0
Component: GritEntityController (modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb)
CSV Export endpoint exposed by the affected controller

Discovery Timeline

2026-06-14 - CVE-2026-12188 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12188

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-74] in the GritEntityController of the Grit42 Grit application. The controller, written in Ruby and located at modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb, processes user-supplied parameters and incorporates them into database queries without sufficient sanitization. According to the public research published on GitHub, the issue manifests in a CSV export endpoint exposed by this controller. An authenticated attacker can submit crafted parameters that alter the structure of the resulting SQL query.

Successful exploitation enables limited read, write, and availability impact against the underlying database, consistent with the CVSS 4.0 vector that requires low privileges and no user interaction. Because the attack is reachable over the network and the exploit is publicly available, defenders should treat any internet-exposed Grit42 instance as at risk despite the low base score.

Root Cause

The root cause is the construction of SQL queries within grit_entity_controller.rb using untrusted input that is not bound through parameterized queries or otherwise neutralized. When user-controlled values flow into clauses used by the CSV export functionality, they reach the database driver as part of the query string itself. This allows an attacker to terminate the intended statement and append additional SQL syntax.

Attack Vector

The attack vector is network-based and requires the attacker to hold a valid low-privileged account on the target Grit42 application. The attacker sends a crafted HTTP request to the CSV export endpoint served by GritEntityController, embedding SQL metacharacters in a vulnerable parameter. The backend assembles the malicious input into a database query, executing the attacker's payload. No user interaction is required, and the exploit has been published in a public vulnerability research repository.

No verified exploit code is reproduced here. Refer to the GitHub Vulnerability Research write-up for technical details of the proof of concept.

Detection Methods for CVE-2026-12188

Indicators of Compromise

HTTP requests to CSV export routes handled by GritEntityController containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in query parameters.
Application or database logs showing syntactically unusual queries originating from the Grit42 backend.
Unexpected CSV export responses containing data outside the requesting user's normal authorization scope.
Database error messages or stack traces surfaced in application logs immediately following requests to the affected endpoint.

Detection Strategies

Inspect Rails application logs for parameters passed to GritEntityController actions and flag values containing SQL syntax tokens.
Deploy a web application firewall (WAF) rule set targeting SQL injection patterns on routes that invoke CSV export.
Enable database query auditing and alert on queries from the Grit42 service account that reference system catalogs or use stacked statements.

Monitoring Recommendations

Monitor authentication logs for low-privileged accounts that begin issuing high volumes of export requests.
Track outbound data volume from the Grit42 host to identify bulk data exfiltration through abused export endpoints.
Correlate failed query events in the database with HTTP 5xx responses from the Grit42 application.

How to Mitigate CVE-2026-12188

Immediate Actions Required

Restrict network access to the Grit42 application to trusted users until a vendor patch is available.
Audit existing user accounts and revoke unnecessary low-privileged access that could be leveraged for exploitation.
Place a WAF in front of the application with rules blocking SQL injection payloads on the CSV export endpoint.
Review database accounts used by the application and enforce least-privilege permissions to limit blast radius.

Patch Information

As of the last NVD update on 2026-06-17, no vendor patch has been published. According to the disclosure, the Grit42 vendor was contacted but did not respond. Monitor the VulDB entry for CVE-2026-12188 and the project's source repository for fixed releases beyond version 0.11.0.

Workarounds

Disable or restrict the CSV export functionality in GritEntityController if it is not required for business operations.
Add input validation middleware that rejects SQL metacharacters in parameters bound to the affected controller actions.
Configure the database role used by Grit42 to deny access to tables and schemas that are not required for normal application function.

bash

# Example WAF rule (ModSecurity) blocking common SQLi tokens on the export route
SecRule REQUEST_URI "@rx /grit/.*\.csv" \
  "id:1012188,phase:2,deny,status:403,\
   chain,msg:'Possible SQLi against GritEntityController (CVE-2026-12188)'"
  SecRule ARGS "@rx (?i)(union(\s|/\*).*select|--|;|/\*|\bor\b\s+1=1)" "t:none"