CVE-2026-111634 is a High severity (CVSS 8.1) SQL injection in Helical Insight through 7.0.0. A viewer account can send unescaped report parameter values to the executeDatasource endpoint and reach data the report does not expose. We could not confirm a fixed version.
What's affected
The record says Helical Insight through 7.0.0 is affected. The researcher write-up says it reviewed v7.0.0 at a pinned commit. We found no fixed release, so check the helicalinsight repository and the vendor.
The weakness is CWE-89, SQL injection. Per the write-up, the endpoint /executeDatasource runs a saved report query against a configured database, and it is reachable by the low privilege viewer role. Report queries use named placeholders filled from request parameters. The code in EfwdQueryProcessor puts the values into the SQL text. Numeric values are not quoted, and string values are quoted without escaping embedded quotes. The query then runs as a plain statement, and not as a prepared one.
The write-up says a guard named SqlDetect exists but reads the wrong place in the request, so it does not stop the values. The record says an attacker can read tables that are not exposed and modify data in the report's data source. Severity differs by source. The record gives 8.1 (High), and VulnCheck lists 8.6 on a CVSS 4.0 vector.
How to check if you're exposed
Check which version of Helical Insight you run, in the application's About page or from the deployed package.
ls /opt | grep -i helical
Version 7.0.0 and earlier are in range per the record. Then check who has accounts. The flaw needs an authenticated account at the viewer role or higher, so a deployment where dashboards are shared with customers or partners is more exposed than one limited to staff.
Review the database account used by report data sources. If it can write to tables or read beyond the reporting schema, the impact grows. Check query logs for statements from report runs that contain unexpected clauses. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Check the vendor and repository for a fixed release, and upgrade once you have confirmed one.
- Reduce the database privileges of each report data source to read-only access on the reporting schema.
- Review who has viewer accounts and remove accounts that are no longer needed.
- Place the application behind a VPN or an allow list, and monitor the database for odd queries from the reporting account.
- If you maintain custom queries, switch placeholders to bound parameters where the platform allows.
Why it matters
SQL injection stays on the list because string concatenation is easy and the fix has to be applied at each query. Escaping the quotes is not enough in general. The dependable fix is a prepared statement, where the values never become part of the SQL text.
Business intelligence tools are a special case, since they are built to run queries for many users against valuable data, with report designers writing the SQL. A viewer who can steer a parameter can reach more than the report was meant to show. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What privilege does the attacker need?
An authenticated viewer account, according to the record.
What reduces the impact before a fix?
Give each data source a database account with read-only access limited to the reporting schema, and remove unused viewer accounts.
Sources
Last reviewed: 18 October 2026.
