CVE-2026-33350: 
NixOS vulnerability analysis and mitigation

CVE-2026-33350 is a SQL injection vulnerability in LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application for neuroimaging research data and project management. The flaw exists in code sections handling the MRI feedback popup window within the imaging browser module. It affects all LORIS versions prior to 27.0.3 and version 28.0.0 (prior to 28.0.1), and was disclosed on April 8, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is incorporated into SQL queries without adequate sanitization or parameterization. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerable code is specifically located in the MRI feedback popup window of the imaging browser component. No public proof-of-concept or detailed technical write-up has been published at this time (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to read and potentially alter sensitive data stored in the LORIS database, which may include confidential neuroimaging research data, participant records, and project management information. The CVSS score reflects a high confidentiality impact with no integrity or availability impact formally scored, though the advisory notes attackers can also alter data on the server. Given LORIS is used in academic and medical research contexts, exposure of participant data could have significant privacy and regulatory consequences (GitHub Advisory).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time. The EPSS score is approximately 0.035%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

The vulnerability is fixed in LORIS versions 27.0.3 (for the 27.x branch) and 28.0.1 (for the 28.x branch). Organizations should upgrade to these patched versions immediately. If immediate patching is not feasible, implement network-level access controls to restrict access to the LORIS application to trusted networks only, and monitor database activity for anomalous SQL patterns originating from the imaging browser component (GitHub Advisory).

The vulnerability received limited public attention, with coverage primarily from automated vulnerability tracking services such as VulnDB and CVE feed aggregators. A brief mention appeared on Bluesky via the CyberHub blog. No significant vendor statements beyond the GitHub security advisory or notable researcher commentary have been identified.