CVE-2026-63489 Details
Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.
An authenticated AQL injection vulnerability has been identified in Yeti versions through 2.5.0. The issue arises because user-controlled sorting fields and filter_aliases are directly interpolated into ArangoDB AQL queries without proper validation. This vulnerability allows a low-privileged authenticated user to inject arbitrary AQL expressions into several search endpoints, including those for observables, entities, indicators, DFIQ, general search, and graph search. The injection points have been verified to allow cross-collection expression evaluation, access to internal collection data, and manipulation of search logic, potentially leading to excessive database resource consumption.
Users are advised to update to Yeti version 2.5.1, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yeti-platform/yeti/commit/89d8b61cf97b0fb2d46c2f9ee8b7411444345fc6 | [email protected] | Source CodeVendor |
| https://github.com/yeti-platform/yeti/pull/1277 | [email protected] | Source CodeVendor |
| https://github.com/yeti-platform/yeti/releases/tag/2.5.1 | [email protected] | Release NotesVendor |
| https://github.com/yeti-platform/yeti/security/advisories/GHSA-vw33-fwfx-6m9p | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yeti | <= 2.5.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |