CRITICAL 9.8
GHSA-7fxj-fr3v-r9gj
TiDB vulnerable to Use of Externally-Controlled Format String
Details
TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/pingcap/tidb
Introduced in:
0 No fixed version published yet for github.com/pingcap/tidb (go modules). Pin to a known-safe version or switch to an alternative.
Go / github.com/pingcap/tidb
Introduced in:
6.2.0 No fixed version published yet for github.com/pingcap/tidb (go modules). Pin to a known-safe version or switch to an alternative.