JetBrains Exposed prior to version 1.5.1 allows attackers to execute SQL injection attacks by supplying unescaped string arguments to several SQL functions. This flaw is identified as CWE-89, a classic injection vulnerability. It can lead to unauthorized reading, modification, or deletion of database contents, potentially compromising confidentiality and integrity of the data stored by the application.

All installations of JetBrains Exposed running a version earlier than 1.5.1 are vulnerable. The CNA product list identifies JetBrains:Exposed as the affected product. No additional version specifics are provided beyond the requirement to upgrade to 1.5.1 or newer.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog; however, the lack of exposure does not reduce the risk. Based on the description, the attack likely originates from inputs that are unsanitized before being passed to SQL functions—this may be via exposed APIs or configuration files, but that is inferred and not explicitly documented. An attacker who can influence these inputs would gain direct control over the database layer, which could lead to full data compromise if the application’s database user has broad privileges.