Casco retweetledi
@getcasco's agents discovered a database takeover (CVSS 10.0) in @ElectricSQL by injecting arbitrary SQL queries into a ORDER BY statement. The expression parser wasn't exhaustively handling all cases and evaluated erroneous SQL statements. Example below:
SELECT * FROM items ORDER BY CAST(
(SELECT * FROM users LIMIT 1) AS int
^^^^^^^^^^^^^^^^^^^^^^^
incorrectly being evaluated
) DESC
The real story is that @balegas, @kylemathews, and the entire ElectricSQL team for turned around a fix and deployed it ~2 hours.
Especially as AI gets better at discovering new vulnerabilities, the ability to move fast and react becomes mission-critical. The ElectricSQL team sets a good pace that others should copy.
Link to full breakdown in thread:
English
