CyberSecBulletin

Cube vulnerabilities

We track 2 vulnerabilities in Cube products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on February 9, 2026.

2vulnerabilities
0critical
2high
0exploited
7.6average CVSS score

Latest Cube vulnerabilities

  • 7.7 High severity

    cube: Reliance on Untrusted Inputs in a Security Decision

    CVE-2026-25958Cube-js

    Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.

  • 7.5 High severity

    Cube is a semantic layer for building data applications.

    CVE-2023-50709Cube-js

    Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recomm