{"id":"CVE-2024-9264","title":"Grafana SQL Expressions allow for remote code execution","summary":"The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-94"],"vendor":"Grafana","product":"Grafana","affected":["Grafana >= 11.0.0 < 11.0.5","Grafana >= 11.1.0 < 11.1.6","Grafana >= 11.2.0 < 11.2.1","Grafana >= 11.0.0 < 11.0.6","Grafana >= 11.1.0 < 11.1.7","Grafana >= 11.2.0 < 11.2.2"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2024-11-01T03:55:22.563345Z"},"exploitAvailable":true,"published":"2024-10-18","updated":"2026-11-04","sourceUpdated":"2026-11-04T00:11:17.366Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-9264","references":[{"url":"https://grafana.com/security/security-advisories/cve-2024-9264/"}],"tags":["cve.org","exploit-available"],"epss":0.97553,"epssPercentile":0.99902,"exploits":{"github":14,"githubRepos":["https://github.com/nollium/CVE-2024-9264","https://github.com/z3k0sec/File-Read-CVE-2024-9264","https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit"],"metasploit":["exploit/multi/http/grafana_sql_expressions_rce_cve_2024_9264"],"nuclei":["CVE-2024-9264"],"checkedAt":"2026-11-05T20:33:42.475Z"},"ingestedAt":"2026-11-05T20:33:06.645Z","slug":"CVE-2024-9264","body":"## Overview\n\nThe SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.\n\n## Affected\n\n- `Grafana >= 11.0.0 < 11.0.5`\n- `Grafana >= 11.1.0 < 11.1.6`\n- `Grafana >= 11.2.0 < 11.2.1`\n- `Grafana >= 11.0.0 < 11.0.6`\n- `Grafana >= 11.1.0 < 11.1.7`\n- `Grafana >= 11.2.0 < 11.2.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":86,"depthScoreParts":{"impact":54.5,"likelihood":19.5,"exploitation":12,"ransomware":0},"changes":[]}