CVE-2026-29953 Details

A SQL injection vulnerability has been identified in SchemaHero version 0.23.0. This vulnerability arises in the PostgreSQL and MySQL plugins when processing column definitions in Table Custom Resource Definitions (CRDs). The issue stems from default values being directly concatenated into SQL statements without proper escaping, allowing for injection attacks. In PostgreSQL, this could lead to the execution of arbitrary functions, while in MySQL, it could allow the injection of additional columns with malicious default values. The vulnerability is automatically exploited when 'Database.spec.immediateDeploy' is set to true, as malicious Table CRDs are executed without manual approval.

Users are advised to update to a version of SchemaHero that addresses this vulnerability. Additionally, 'Database.spec.immediateDeploy' should be set to false to require manual approval for all migrations. Implementing RBAC restrictions to limit who can create Table CRDs and monitoring audit logs for CRD modifications can also help mitigate the risk.