CVE-2026-33643

Name of the Vulnerable Software and Affected Versions SchemaHero version 0.23.0

Description A SQL Injection issue exists in SchemaHero version 0.23.0. The issue is due to a flaw in the mysqlColumnAsInsert function within the plugins/mysql/lib/column.go file, specifically related to the column parameter. This allows for potential manipulation of SQL queries. The column parameter is vulnerable.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the mysqlColumnAsInsert function until a patch is available.