VYPR
← All advisories
Moderate severityOSV Advisory· Published Jan 8, 2026· Updated Jan 8, 2026

Parsl Monitoring Visualization Vulnerable to SQL Injection

CVE-2026-21892

Description

Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
parslPyPI
< 2026.01.052026.01.05

Affected products

1

Patches

1
013a928461e7

Switch two visualization views to safer SQL parameter style (#4049)

https://github.com/Parsl/parslBen CliffordJan 5, 2026via ghsa
commit
1 file changed · +8 −6
  • parsl/monitoring/visualization/views.py+8 −6 modified
    @@ -1,4 +1,5 @@
 import pandas as pd
+import sqlalchemy
 from flask import current_app as app
 from flask import render_template
 
@@ -143,9 +144,9 @@ def workflow_dag_details(workflow_id, path):
                                        FROM status
                                        WHERE status.task_id = task.task_id and status.run_id = task.run_id
                                       )
-               WHERE task.run_id='%s'""" % (workflow_id)
+               WHERE task.run_id=:run_id"""
 
-    df_tasks = pd.read_sql_query(query, db.engine)
+    df_tasks = pd.read_sql_query(sqlalchemy.text(query), db.engine, params={"run_id": workflow_id})
 
     group_by_apps = (path == "group_by_apps")
     return render_template('dag.html',
@@ -166,10 +167,11 @@ def workflow_resources(workflow_id):
                                message="Workflow %s does not have any resource usage records." % workflow_id)
 
     df_task = queries.tasks_for_workflow(workflow_id, db.engine)
-    df_task_tries = pd.read_sql_query("""SELECT task.task_id, task_func_name,
-                                      task_try_time_launched, task_try_time_running, task_try_time_returned from task, try
-                                      WHERE task.task_id = try.task_id AND task.run_id='%s' and try.run_id='%s'"""
-                                      % (workflow_id, workflow_id), db.engine)
+
+    query = """SELECT task.task_id, task_func_name,
+               task_try_time_launched, task_try_time_running, task_try_time_returned from task, try
+               WHERE task.task_id = try.task_id AND task.run_id=:run_id and try.run_id=task.run_id"""
+    df_task_tries = pd.read_sql_query(query, db.engine, params={"run_id": workflow_id})
     df_node = queries.nodes_for_workflow(workflow_id, db.engine)
 
     return render_template('resource_usage.html', workflow_details=workflow_details,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.