CVE-2022-38540 - Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface

CRITICAL

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface

Published Sep 13, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.13%

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

Link	Providers	Tags
https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/		Third Party Advisory
https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L148		Third Party Advisory
https://github.com/hhyo/Archery/issues/1841		Third Party Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Sep 13, 2022

Updated Aug 3, 2024

Reserved Aug 22, 2022

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a