CVE-2024-9264

high

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.

Vendor / product: Grafana — grafana

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

CVSS

8.8

8.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2024-10-18 04:15

Modified: 2026-11-04 01:17

NVD status: Modified

Last synced 1 day ago

Verified against the source API 2026-11-04 01:26 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

grafana / grafana 11.0.0

Weakness classification (CWE)

CWE-94 CWE-77

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://grafana.com/security/security-advisories/cve-2024-9264/

References

https://grafana.com/security/security-advisories/cve-2024-9264/ security@grafana.com
https://security.netapp.com/advisory/ntap-20250314-0007/ af854a3a-2127-422b-91ae-364da2661108

Data sources

NVD CVE API 2.0 — fetched 2026-11-04 01:26 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2024-9264

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs