CVE-2026-115331

HIGH 8.8

Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.

CWE	CWE-89
Vendor	uselotus
Product	lotus
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for uselotus lotus

Be the first to know when new high vulnerabilities affecting uselotus lotus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

uselotus / lotus

0 ≤ 0.10.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/BkUc3WL2Mx github.com: https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/counter_query_templates.py#L14 github.com: https://github.com/uselotus/lotus vulncheck.com: https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters

Credits

leediay153 from Viettel Post