SQLFluff vulnerabilities
3 known CVE vulnerabilities in SQLFluff, translated and rated.
- CVE-2026-46374High
SQLFluff, a modular SQL linter and auto-formatter, prior to version 4.2.0 is vulnerable to a DoS attack via resource exhaustion. An untrusted user can submit a malicious long SQL query, causing parser overload.
- CVE-2026-46373High
SQLFluff prior to version 4.1.0 is vulnerable to a DoS attack via resource exhaustion. An untrusted user can submit a malicious SQL query with excessive nesting, causing parser overload.
- CVE-2023-36830Medium
SQLFluff, a SQL linter, prior to version 2.1.2 had a vulnerability that allowed untrusted users to execute arbitrary Python code by modifying the `library_path` value in configuration files. Version 2.1.2 introduces the ability to overwrite this value from the command line, mitigating the risk.