Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-56221

Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can inject arbitrary SQL through deviceIds, search, version_name, cursor, and actions parameters to access analytics data belonging to other users or applications.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cap-go capgo

Default version status: unaffected

  • 0 to < 12.128.2affected
  • 12.128.2unaffected
pkg:npm/capgo

References