Blvck-Ltr

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.3.4 **Description** SQL Injection occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. This allows attackers to inject arbitrary SQL expressions into the database query. **Recommendations** Update to a version newer than 1.3.3.

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.3.7 **Description** Kestra, an open-source event-driven orchestration platform, contains a SQL Injection flaw in the 'GET /api/v1/main/flows/search' endpoint. An authenticated user can trigger this issue by visiting a crafted link. The vulnerability allows the execution of arbitrary operating system commands on the host because the injected payload is processed by PostgreSQL using the COPY ... TO PROGRAM ... functionality, leading to Remote Code Execution (RCE). **Recommendations** Update to version 1.3.7.