What is GHSA-gr7f-9f5r-v3mg?

GHSA-gr7f-9f5r-v3mg is a security advisory published by GitHub Security Advisories with Medium severity. An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put...

Which CVE IDs does GHSA-gr7f-9f5r-v3mg cover?

GHSA-gr7f-9f5r-v3mg covers the following CVE IDs: CVE-2026-93684. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gr7f-9f5r-v3mg?

GHSA-gr7f-9f5r-v3mg has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-gr7f-9f5r-v3mgMediumCVSS 5.4

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-93684 →

📋 Description

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-93684
https://lists.apache.org/thread.html/qxjj5n3vsttxbvq2n75xcy2qcrhtxowx
http://www.openwall.com/lists/oss-security/2026/10/07/21
https://github.com/advisories/GHSA-gr7f-9f5r-v3mg