Lotus: SQL injection via billable metric property names and filters
Summary
Lotus through 0.10.2, an open-source pricing and billing platform, does not properly escape billable metric property names and categorical filter values in the Jinja-generated counter, gauge and rate metric queries. An authenticated user of an organization can inject SQL through crafted values and read or manipulate the database, which is shared by all tenants. The CNA scores the issue with CVSS v4.0 8.7 (High) and assesses it as automatable over the network with low privileges and no user interaction.
Affected
- Lotus (uselotus/lotus) versions 0.10.0 up to and including 0.10.2 (according to VulnCheck; VulDB lists 0.10.0, 0.10.1 and 0.10.2)
Fixed in
Unknown. No patched release was found at the time of research.
Workaround
Unknown. No vendor-documented workaround was found.
Exploitation
- No evidence of known exploitation (KEV/ITW) was found.
- Public proof of concept: not confirmed; VulDB reports no exploit available.
- CISA SSVC: exploitation status 'poc', not automatable.
- Related SQL injection issues in the same product (CVE-2026-115330, CVE-2026-115332) are reported by the same researcher.
Our recommendation
- Check whether any system runs Lotus 0.10.2 or earlier (source code, container images, deployment manifests).
- If Lotus is in use, treat this as high priority because of the cross-tenant impact.
- Restrict who can hold organization accounts and place the application behind access control.
- Run the database account with least privilege.
- Monitor the upstream project and vendor for a fix and apply it as soon as one is released; test changes in staging first.
- Assess related CVE-2026-115330 and CVE-2026-115332 together with this issue.
- If Lotus is not in use, no action is needed beyond confirming that.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: Lotus through 0.10.2 SQL Injection www.vulncheck.com
- Researcher write-up (HackMD) hackmd.io
- Lotus GitHub repository github.com
- counter_query_templates.py at 0.10.2 github.com
- VulDB entry 425284 vuldb.com
- HOL Guard CVE-2026-115331 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:45.
Original description (NVD)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
NVD references (5)
- https://github.com/uselotus/lotus
- https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/counter_query_templates.py…
- https://hackmd.io/@leediay/BkUc3WL2Mx
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-metric-property-names-and-filters
- https://hackmd.io/@leediay/BkUc3WL2Mx
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.