Helical Insight: SQL injection via report parameters in /executeDatasource
Summary
Helical Insight through 7.0.0 contains an SQL injection flaw in the /executeDatasource endpoint. Report parameter values are inserted into SQL queries without proper escaping, and a broken injection guard fails to block them. An authenticated user with the low-privilege viewer role can read tables not exposed in the report and modify data in the report's data source.
Affected
- Helical Insight through 7.0.0 (CVE record: affected 0 to <= 7.0.0)
- Exact version range according to the vendor: Unknown.
Fixed in
- Fixed versions: Unknown. No vendor advisory or patched version was found.
Workaround
- No vendor-published workaround known.
- Restrict viewer accounts to those required and remove unused accounts.
- Do not expose the Helical Insight server to the public internet; limit access to VPN or internal networks.
- Connect reporting to the database with a read-only, least-privilege account without access to unrelated schemas.
Exploitation
- Authentication required: a valid viewer account.
- Public technical write-up exists; a proof of concept is possible but not confirmed.
- CISA SSVC: exploitation status PoC, automatable: no.
- Not known to be actively exploited according to the sources checked.
Our recommendation
- Inventory all Helical Insight instances and their versions.
- Restrict network access and review viewer accounts now.
- Enable audit and database logging and check for unusual report-parameter requests.
- Ask Helical IT Solutions for a written advisory and a patched version, and reassess weekly until a fix is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-111634 at VulDB vuldb.com
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- EfwdQueryProcessor.java at v7.0.0 github.com
- HOL CVE record hol.org
- Vulners VulnCheck record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:52.
Original description (NVD)
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
NVD references (4)
- https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/dat…
- https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
- https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource
- https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.