Listen to this Post
The vulnerability exists in the Table Object Handler component of the bluelabsio records-mover library versions up to 1.5.4. An attacker with local access can exploit an unknown function within this handler to inject malicious SQL commands. This occurs when user-supplied input is not properly sanitized before being used in SQL queries related to table operations. The attack is launched locally, meaning the attacker must already have access to the system where records-mover is executing. By manipulating inputs to the Table Object Handler, such as table names or parameters, arbitrary SQL code can be executed against the underlying database. This could lead to unauthorized data access, modification, or deletion. The vulnerability stems from insufficient input validation, allowing SQL injection through crafted local requests. The fix involves upgrading to version 1.6.0, which addresses the input sanitization flaw in the handler.
Platform: records-mover
Version: up to 1.5.4
Vulnerability: SQL Injection
Severity: Moderate
date: Jan 7 2026
Prediction: Patch Jan 8 2026
What Undercode Say:
Analytics
pip show records-mover pip install records-mover==1.6.0 git clone https://github.com/bluelabsio/records-mover cd records-mover git checkout 3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa
How Exploit
Local access required.
Inject SQL via handler.
Execute arbitrary queries.
Protection from this CVE
Upgrade to 1.6.0.
Apply patch 3f8383aa.
Sanitize user inputs.
Impact
Data theft possible.
Database corruption risk.
Local privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
