CVE-2024-9264

CVE-2024-9264 is a critical command injection and local file inclusion vulnerability affecting Grafana's experimental SQL Expressions feature, specifically when evaluating duckdb queries. It allows any authenticated user (VIEWER or higher) to execute arbitrary commands or read local files due to insufficient sanitization of user input. This vulnerability has a CVSS score of 8.8 (HIGH) and an EPSS score of 0.94, indicating a high likelihood of exploitation, with potential for complete compromise of confidentiality, integrity, and availability. While not yet in CISA KEV, public exploit code is available on GitHub and Nuclei templates exist for post-authentication file reading, suggesting active community interest and potential for widespread exploitation.