CVE-2022-39361
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.61%
- CWE
- CWE-20, CWE-441
- Published
- 2022-10-26
- Last modified
- 2026-03-13
Affected products
- metabase metabase
- metabase metabase
- metabase metabase
- metabase metabase
- metabase metabase
- metabase metabase
- metabase metabase
- metabase metabase
Weakness type
Related vulnerabilities
- CVE-2026-78900 — Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exec
- CVE-2026-79111 — Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execu
- CVE-2026-79230 — Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potent
- CVE-2026-79182 — Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exec
- CVE-2026-78963 — Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exec
- CVE-2026-79008 — Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had
- CVE-2026-87553 — Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had com
- CVE-2026-87510 — Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromis