Critical severity9.8OSV Advisory· Published Dec 10, 2024· Updated Jun 17, 2026

CVE-2024-55586

Description

Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
nette/databasePackagist	<= 3.2.4	—

Affected products

Nette/DatabaseOSV
Range: v2.3.0, v2.3.1, v2.3.2, …
ghsa-coords
pkg:composer/nette/database
Range: <= 3.2.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-f626-677r-j5vqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-55586ghsaADVISORY
github.com/github/advisory-database/pull/5079ghsaWEB
github.com/nette/database/releasesnvdWEB
www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.htmlnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000