{"id":"CVE-2026-63393","aliases":[],"cve":{"records":[{"id":"CVE-2026-63393","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-16T17:39:30.171Z","published":"2026-10-30T22:22:05.735Z","modified":"2026-10-30T22:22:05.735Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:22:05.735Z"}],"references":[{"url":"https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/opensearch-project/sql/pull/5469","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/opensearch-project/sql/pull/5572","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/opensearch-project/sql/releases/tag/2.19.6.0","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/opensearch-project/sql/releases/tag/3.7.0.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.","score":8.7,"severity":"high","published":"2026-10-30T22:22:05.735Z","modified":"2026-10-30T22:22:05.735Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"opensearch-project","name":"sql","platforms":[],"versions":[{"version":">= 2.8.0.0, < 2.19.6.0","status":"affected"},{"version":">= 3.0.0.0-alpha1, < 3.7.0.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-63393"}],"remediation":[],"references":["https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4","https://github.com/opensearch-project/sql/pull/5469","https://github.com/opensearch-project/sql/pull/5572","https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de","https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db","https://github.com/opensearch-project/sql/releases/tag/2.19.6.0","https://github.com/opensearch-project/sql/releases/tag/3.7.0.0"],"sources":[{"name":"CVE","id":"CVE-2026-63393","modified":"2026-10-30T22:22:05.735Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63393"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.7}],"sourceAffected":[],"observedAt":"2026-10-30T22:47:34.757Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T22:55:32.505Z","attemptedAt":"2026-10-30T22:55:32.505Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T22:55:32.662Z","attemptedAt":"2026-10-30T22:55:32.662Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T22:55:33.005Z","attemptedAt":"2026-10-30T22:55:33.005Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T22:55:32.896Z","attemptedAt":"2026-10-30T22:55:32.896Z"}],"evidence":[],"aiSummary":{"text":"OpenSearch SQL plugin versions 2.8.0.0 to 2.19.6.0 and 3.0.0.0-alpha1 to 3.7.0.0 are affected by unsafe cursor deserialization, allowing authenticated users with basic read/search permissions to trigger arbitrary code execution. The weakness is deserialization of untrusted data. This issue is fixed in releases 2.19.6.0 and 3.7.0.0.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:11:14.747Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-63393"}]}}