Cube-js vulnerabilities
We track 3 vulnerabilities in Cube-js products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 9, 2026.
Latest Cube-js vulnerabilities
- 7.7 High severity
cube: Reliance on Untrusted Inputs in a Security Decision
Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.
- 7.5 High severity
Cube is a semantic layer for building data applications.
Cube is a semantic layer for building data applications. Prior to version 0.34.34, it is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint. The issue has been patched in `v0.34.34` and it's recomm
- 8.8 High severity
cube.js: Improper Neutralization of Special Elements used in an SQL Command
cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint. This issue has been resolved in version 0.31.24.