{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121881","assignerOrgId":"8c484e69-127d-402b-9cdb-5f86ef43eb86","state":"PUBLISHED","assignerShortName":"POSIT","dateReserved":"2026-11-04T10:49:23.575Z","datePublished":"2026-11-06T15:10:17.246Z","dateUpdated":"2026-11-06T17:45:42.672Z"},"containers":{"cna":{"providerMetadata":{"orgId":"8c484e69-127d-402b-9cdb-5f86ef43eb86","shortName":"POSIT","dateUpdated":"2026-11-06T15:13:00.535Z"},"title":"Posit Workbench code-server session-state RPC (get_last_seen) SQL injection","datePublic":"2026-11-04T00:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"affected":[{"vendor":"Posit Software, PBC","product":"Posit Workbench","platforms":["Linux"],"collectionURL":"https://posit.co/download/rstudio-server-pro/","modules":["code-server session-state RPC (get_last_seen)"],"versions":[{"status":"affected","version":"0","lessThan":"2026.08.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":["cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:*"]}],"descriptions":[{"lang":"en","value":"SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter.\n\n\n\nNOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>SQL injection vulnerability in the <code>get_last_seen</code> code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the <code>sessionIds</code> parameter.</p><p>NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.</p>"}]}],"references":[{"url":"https://docs.posit.co/ide/news/#rstudio-2026.08.0","name":"Posit Workbench release notes","tags":["release-notes","vendor-advisory"]},{"url":"https://trust.posit.co/updates","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"AUTOMATIC","valueDensity":"CONCENTRATED","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:C/RE:M/U:Amber"}}],"configurations":[{"lang":"en","value":"Affects Posit Workbench deployments with the code-server (VS Code / Positron) session-state feature enabled, reachable over HTTP by any authenticated user.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Affects Posit Workbench deployments with the code-server (VS Code / Positron) session-state feature enabled, reachable over HTTP by any authenticated user.</p>"}]}],"solutions":[{"lang":"en","value":"Upgrade to Posit Workbench 2026.08.0 or later. The patched release binds the caller-supplied session identifiers as query parameters instead of concatenating them into the SQL statement.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Posit Workbench 2026.08.0 or later. The patched release binds the caller-supplied session identifiers as query parameters instead of concatenating them into the SQL statement.</p>"}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-06T17:20:53.037205Z","id":"CVE-2026-121881","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-06T17:45:42.672Z"}}]}}