CVE-2025-54379 is a critical (CVSS 9.8) SQL injection in the getLast API of LF Edge eKuiper, the IoT stream processing engine. Unauthenticated remote attackers can run SQL against the underlying SQLite database. Versions before 2.2.1 are affected; upgrade to 2.2.1.
What's affected
- LF Edge eKuiper before 2.2.1 is affected, per the record.
- Version 2.2.1 is the fixed release named in the advisory.
The record lists CVSS 9.8 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the version of the running binary or container image tag. If you run it in a container, list the image.
docker ps --format "{{.Names}} {{.Image}}"
Then check whether the REST API port is reachable from networks other than your own management network.
What to do now
- Upgrade eKuiper to 2.2.1 or later.
- Restrict the REST API to trusted networks until the upgrade is done.
- Put authentication in front of the API if your deployment lacks it.
- Back up the SQLite data before and after the change, and review it for unexpected changes.
- Check logs for unusual table names in API requests.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-89. The record says the table name supplied to the getLast API reaches the database as part of a statement. Identifiers like table names cannot be bound as parameters, so they need an allow list or strict validation.
Edge deployments often skip the network controls that a data centre service would have. An unauthenticated API on a device network is a common way for a small bug to become a large one. The record does not flag KEV status.
Severity scores are a starting point. The score for this entry is 9.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Does exploitation need credentials?
Per the record, no. The attacker is unauthenticated.
Why is table name injection hard to prevent with parameters?
Databases bind values, not identifiers. The fix is to check the name against known tables.
Sources
- https://github.com/lf-edge/ekuiper/commit/72c4918744934deebf04e324ae66933ec089ebd3
- https://github.com/lf-edge/ekuiper/security/advisories/GHSA-526j-mv3p-f4vv
Last reviewed: 18 October 2026.
