CVE-2026-33142: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33142 is a SQL injection vulnerability in OneUptime's ClickHouse query construction layer, specifically affecting the StatementGenerator class. It is an incomplete fix for a prior vulnerability (GHSA-p5g2-jm85-8g35): while column name validation was added to the _aggregateBy method, three other query-building methods — toSortStatement, toSelectStatement, and toGroupByStatement — remained unprotected. The vulnerability affects all versions of the oneuptime npm package prior to 10.0.34. It was published on March 17, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, OneUptime Advisory).

The root cause is CWE-89 (SQL Injection): StatementGenerator.ts iterates over user-provided object keys to build ClickHouse SQL queries in toSortStatement (line 467), toSelectStatement (line 483), and toGroupByStatement (line 451) without calling this.model.getTableColumn(key) to validate that keys correspond to actual model columns — a check that already exists in toWhereStatement. In Statement.ts, string values passed to the SQL tagged template are assigned the ClickHouse Identifier data type, which is substituted directly into queries without quoting or escaping. The attack path begins in BaseAnalyticsAPI.ts, which deserializes sort, select, and groupBy directly from req.body (lines 239–253) and passes them to the service layer without any column validation, allowing an authenticated attacker to inject arbitrary SQL via crafted API request bodies (GitHub Advisory, OneUptime Advisory).

A low-privileged authenticated attacker can inject arbitrary ClickHouse SQL through crafted sort, select, or groupBy keys in API requests to any analytics list or aggregate endpoint, including those handling logs, metrics, spans, and exceptions. Successful exploitation enables unauthorized reading, modification, or deletion of analytics data stored in ClickHouse, resulting in high confidentiality and high integrity impact. PostgreSQL data is not affected as it uses a separate query path. There is no availability impact reported (GitHub Advisory, OneUptime Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires low privileges (authenticated access) and no user interaction, and is reachable over the network with low attack complexity, making it relatively straightforward to exploit once access is obtained. The EPSS score is approximately 0.026% (0.014% per GitHub Advisory), placing it in the 3rd percentile for exploitation likelihood. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog.

1. Authenticate: Obtain low-privileged credentials to the target OneUptime instance (e.g., a standard user account with access to analytics endpoints).
2. Identify target endpoints: Locate analytics list or aggregate API endpoints backed by BaseAnalyticsAPI.getList() or BaseAnalyticsAPI.getAggregate(), such as those for logs, metrics, spans, or exceptions.
3. Craft malicious request body: Construct a JSON request body where the sort, select, or groupBy field contains object keys with injected SQL identifiers, e.g.:

{
  "sort": { "column_name, (SELECT sensitive_data FROM system.tables LIMIT 1)--": "ASC" }
}

4. Send the request: Submit the crafted HTTP POST/GET request to the analytics endpoint. The BaseAnalyticsAPI.ts deserializes the body without validation and passes the keys to StatementGenerator.
5. Achieve SQL injection: The unvalidated key is interpolated as a ClickHouse Identifier directly into the query without escaping, executing the injected SQL and returning or modifying data from the ClickHouse database (GitHub Advisory, OneUptime Advisory).

• Network: Unusual or malformed HTTP requests to analytics API endpoints (e.g., /api/analytics/...) with sort, select, or groupBy body parameters containing SQL syntax, special characters, or unexpected identifier strings.
• Logs: Application logs showing BadDataException errors (if partially patched) or unexpected ClickHouse query errors; access logs with POST requests to analytics endpoints from authenticated users with anomalous payload sizes or structures.
• ClickHouse Query Logs: ClickHouse system.query_log entries containing injected SQL fragments, unexpected SELECT subqueries, or references to system tables (e.g., system.tables, system.columns) originating from the OneUptime service account.
• Application Behavior: Unexpected data modifications or deletions in ClickHouse analytics tables (logs, metrics, traces, spans) without corresponding legitimate user activity.

Upgrade the oneuptime npm package to version 10.0.34 or later, which applies getTableColumn() validation to toSortStatement, toSelectStatement, and toGroupByStatement — matching the fix already applied to toWhereStatement and _aggregateBy (GitHub Advisory, OneUptime Advisory). As a temporary workaround, implement network-level access controls to restrict access to analytics and aggregate API endpoints to trusted users or IP ranges only. Review audit and ClickHouse query logs for suspicious requests containing SQL syntax in sort, select, or groupBy parameters.

The vulnerability was reported by researcher vnykmshr and published by maintainer simlarsen on March 17, 2026 (OneUptime Advisory). Brief community discussion was observed on Mastodon and Bluesky following NVD publication on March 20, 2026, with automated CVE tracking accounts noting the disclosure. No significant media coverage or notable researcher commentary beyond the advisory itself has been identified.