CVE-2025-53639 is a Critical severity SQL injection (CVSS 9.8) in MeterSphere, the open source continuous testing platform. The sortField parameter in some API endpoints is not validated, which allows injected SQL. Version 3.6.5-lts fixes the issue, so upgrade to it or later.
What's affected
The advisory says versions prior to 3.6.5-lts are affected. The fixed version is 3.6.5-lts.
The weak spot is the sortField parameter in certain API endpoints, which feeds the sorting function of the query. The advisory says an attacker could modify or delete database contents, with a potential full compromise of database integrity and availability.
The record does not name the endpoints one by one, so do not try to defend by blocking a single route. Treat every list style API as in scope until the upgrade is done.
How to check if you're exposed
Find your version in the MeterSphere interface or from the image tag you deployed:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i metersphere
If the tag is older than 3.6.5-lts, you are affected. If you run it under Kubernetes or Compose, read the image tag from your manifest.
Then look at your access logs for API calls that carry a sortField value with unusual characters or long strings, and at the database logs for syntax errors that come from the application account. Both are signs that someone has been probing the parameter.
What to do now
- Upgrade MeterSphere to 3.6.5-lts or later and restart every node.
- Until the upgrade is done, restrict the platform to your office network or a VPN.
- Check the database account used by MeterSphere. It should not have rights outside its own schema.
- Review recent changes to test data and project settings for edits you cannot explain, and restore from backup if you find any.
- Take a database backup before and after the upgrade so you have a clean point to return to.
Why it matters
The weakness is CWE-89, SQL injection. Sort columns are a well known blind spot. Most developers know to bind values, but a column name in an order by clause cannot be bound in the same way, so teams paste the name into the query and forget to check it.
The safe approach is an allow list. Map the sort names a client may ask for to fixed column names in code, and refuse everything else. The advisory shows that this check was missing in the affected endpoints.
The record is not in the CISA Known Exploited Vulnerabilities catalogue. The advisory does not mention attacks, but the stated impact on database integrity and availability is reason enough to patch promptly.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the fix in 3.6.5-lts only?
The advisory names 3.6.5-lts as the fixed version. Later releases should include it, but check the release notes for the line you follow.
Why is a sort parameter risky?
Because column names cannot be passed as bound parameters, so code often builds that part of the query as plain text. If the name is not checked against an allow list, it becomes an injection point.
Sources
Last reviewed: 18 October 2026.
