What is GHSA-chxj-gxww-q98w?

GHSA-chxj-gxww-q98w is a security advisory published by GitHub Security Advisories with Medium severity. Improper escaping of database table names in the CaptureChangeMySQL Processor included with...

Which CVE IDs does GHSA-chxj-gxww-q98w cover?

GHSA-chxj-gxww-q98w covers the following CVE IDs: CVE-2026-44913. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-chxj-gxww-q98w?

GHSA-chxj-gxww-q98w has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-chxj-gxww-q98wMediumCVSS 7.2

Improper escaping of database table names in the CaptureChangeMySQL Processor included with...

Vendor

GitHub Security Advisories

Published

June 22, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-44913 →

📋 Description

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-44913
https://lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmsl
http://www.openwall.com/lists/oss-security/2026/06/20/5
https://github.com/advisories/GHSA-chxj-gxww-q98w