PT-2026-49145 · Grit42 · Grit

Nmmorette · Published 2026-06-14 · Updated 2026-06-14 · CVE-2026-12188

Mitre

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers/concerns/grit/core/grit entity controller.rb of the component GritEntityController. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-12188

Affected Products

Grit

References · 6

• 🔥 https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/blob/main/2026/SQL%20Injection%20in%20grit42%20CSV%20Export%20Endpoint/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12188 · Security Note
• https://vuldb.com/cve/CVE-2026-12188 · Note
• https://vuldb.com/vuln/370834 · Note
• https://vuldb.com/submit/816680 · Note
• https://vuldb.com/vuln/370834/cti · Note