CVE-2026-111866 is a high severity (CVSS 7.3 in the record) SQL injection in nemoTyrant manong up to commit 7c9e522. Three functions in func.php build queries from request values. The project is rolling release and no fixed commit was confirmed. The sections below cover affected versions, how to check, and what to do first.
What's affected
manong up to commit 7c9e5228e133b9267ad3a415833bc9bb53193bb4, per the record. The functions named are cache, del_cache and arr2sql in func.php. The record says the project uses a rolling release model, so there are no version numbers, and the linked GitHub issue was closed as completed without a traceable fix.
Scoring differs by source. The record rates it 7.3, High. The public write-up I fetched, a GitHub gist by an independent researcher, scores it 9.4 Critical under CVSS 3.1 with the same unauthenticated, network reachable assessment. The title follows the record. Treat both as a sign that the issue is serious.
How to check if you're exposed
If you run manong, check which commit you have with git log. Any commit up to 7c9e522 is affected. The gist notes the repository has had no commits since 2017.
Search your own copy for raw interpolation into PDO calls:
grep -n "query(\|exec(" func.php
Review web logs for requests to the crawl, add and del actions.
What to do now
- Find any copy of manong in use.
- Take it off public networks, because the record says no login is required.
- Back up and review the database for unexpected rows or deletions.
- If you must keep it, rewrite the affected queries with prepared statements.
- Consider moving to a maintained alternative, since the project appears inactive.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-89, SQL injection, with CWE-74, injection in general, also listed. The code concatenates request values into SQL text and runs it through PDO's query and exec calls. Prepared statements are not used on those paths.
The project is a small hobby crawler, but the pattern is the common one: no layer between the request and the database. Abandoned projects with no fix path are a supply chain risk of their own. It is not listed in CISA KEV.
Quick check
Which score should I use?
The record says 7.3 High and one researcher says 9.4 Critical. Either way, remove public access.
Will a patch arrive?
The record says no fixing commit could be identified, so plan on mitigating yourself.
Sources
Last reviewed: 18 October 2026.
