An experimental feature named SQL Expressions was recently added to Grafana (as part of 11.0.0) that allows for query output to be post-processed using SQL; these SQL queries were incompletely sanitized, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.

Due to an incorrect implementation of feature flags, this experimental feature is enabled by default for the API. However, to be exploitable, the Grafana process’ PATH must contain the DuckDB binary– if DuckDB is not present, the system is not vulnerable. The DuckDB binary is not packaged with Grafana by default, so to be exploitable a system must explicitly install it and include it in Grafana’s PATH.