PoC Archive PoC Archive

tag

Data-Pipeline

  • CVE-2026-41490 web HIGH

    Dagster Database I/O Manager SQL Injection via Dynamic Partition Keys (CVE-2026-41490)

    All five Dagster database I/O-manager packages share a copy-pasted helper, staticwhereclause, that builds SQL WHERE/DELETE clauses by f-string-interpolating partition key values with no escaping. For statically defined partitions this is safe because the…

    Patched 2026-07-05
  • CVE-2025-30065 misc CRITICAL 10 EPSS 41%

    Apache Parquet Java Unsafe Deserialization RCE (CVE-2025-30065)

    CVE-2025-30065 is an unsafe deserialization issue in Apache Parquet Java schema handling that can instantiate attacker-controlled classes while parsing malicious Parquet/Avro metadata. The provided PoC demonstrates two practical outcomes: arbitrary command…

    Patched 2026-05-16