What is GHSA-fxfp-52cf-vm9r?

GHSA-fxfp-52cf-vm9r is a security advisory published by GitHub Security Advisories with Medium severity. OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries,...

Which CVE IDs does GHSA-fxfp-52cf-vm9r cover?

GHSA-fxfp-52cf-vm9r covers the following CVE IDs: CVE-2026-93983. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fxfp-52cf-vm9r?

GHSA-fxfp-52cf-vm9r has a CVSS v3 base score of 5.0, published by GitHub Security Advisories.

GHSA-fxfp-52cf-vm9rMediumCVSS 5.0

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries,...

Vendor

GitHub Security Advisories

Published

September 19, 2026

Last Modified

September 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-93983 →

📋 Description

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

🔗 References (4)

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-cc5p-97vc-8fwv
https://nvd.nist.gov/vuln/detail/CVE-2026-93983
https://www.vulncheck.com/advisories/openpanel-sql-injection-via-clickhouse-property-key-filter
https://github.com/advisories/GHSA-fxfp-52cf-vm9r