Repository: migration-planner  
Priority: High  
Location: pkg/duckdb_parser/inventory_builder.go:65 → pkg/duckdb_parser/builder.go

Description:  
Users upload RVTools .xlsx exports which DuckDB ingests safely. The inventory builder then runs SELECT DISTINCT "Cluster" FROM vinfo to enumerate cluster names and feeds each returned string back into ~27 query templates via text/template - unescaped, inside single quotes. A spreadsheet cell like x' UNION SELECT read_text('/var/run/secrets/kubernetes.io/serviceaccount/token') -- becomes executable SQL on the second pass.

Security Impact:  

DuckDB worker runs in-process inside planner-api pod without sandbox

DuckDB's read_text()/read_blob() enable arbitrary file read on pod

Can access Kubernetes service-account token, Postgres credentials, agent-JWT signing key

Single tenant's xlsx upload escalates to full SaaS compromise

Fix Suggestion:  
Apply existing escapeSQLString() helper (already used for ClusterFeaturesQuery) to every string field of queryParams before template execution. Patch covers all 27 call sites in builder.go. Long-term: prefer DuckDB prepared statements over text/template. See patches/f007.patch.