Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts
Description
Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can inject arbitrary SQL through deviceIds, search, version_name, cursor, and actions parameters to access analytics data belonging to other users or applications.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"User-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization."
Attack vector
An authenticated attacker with a read-level API key sends a crafted POST request to either `/private/devices` or `/private/stats`. The `deviceIds` field is validated as `z.array(z.string())`, which only checks the type, not the content, so SQL payloads pass validation. The attacker can inject arbitrary SQL into Cloudflare Analytics Engine queries, enabling cross-tenant data access and exfiltration of analytics data belonging to other users or applications [ref_id=1].
Affected code
The vulnerability resides in `supabase/functions/_backend/utils/cloudflare.ts`. Multiple user-controlled parameters (`deviceIds`, `search`, `version_name`, `cursor`, `actions`, `app_id`) are interpolated directly into SQL query strings without sanitization or parameterization. The most critical injection point is at lines 668-669 where `deviceIds` are joined without any quoting or escaping [ref_id=1].
What the fix does
The advisory recommends creating a `sanitizeSqlString()` utility that escapes single quotes by doubling them (`'` → `''`) and applying strict input validation regexes (e.g., `/^[a-zA-Z0-9_\-:.]+$/` for device IDs) to all user-controlled values. This prevents SQL injection by ensuring that attacker-supplied strings cannot break out of the intended query structure [ref_id=1].
Preconditions
- authAttacker must possess a valid read-level API key for the Cap-go application.
- networkAttacker must be able to send POST requests to the `/private/devices` or `/private/stats` endpoints.
- inputThe `deviceIds` parameter (or other listed parameters) must contain a string that passes the `z.array(z.string())` Zod validation but includes SQL metacharacters.
Generated on Jun 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-f83x-p28r-pf74mitrevendor-advisory
- www.vulncheck.com/advisories/cap-go-sql-injection-in-cloudflare-analytics-engine-queries-via-cloudflare-tsmitrethird-party-advisory
News mentions
0No linked articles in our index yet.