SQL injection vulnerability in Trellix DLP on‑prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject arbitrary SQL queries because the application does not sanitize input or use parameterized queries. The attacker could therefore read, modify or delete data stored in the product’s database, potentially compromising confidentiality, integrity or availability of the data managed by the DLP system.

The vulnerability is limited to Trellix DLP on‑prem extensions software version 11.13.1 and all earlier releases. Systems running these versions are exposed when authenticated users have write access to the application’s back‑end.

The CVSS score of 7.1 indicates a high impact vulnerability. Although no EPSS score is available, the absence of a KEV listing suggests that documented active exploitation has not yet been reported. The likely attack vector is remote authenticated, requiring the attacker to obtain valid credentials with at least read or write permissions to the application. Once authenticated, the attacker could exploit the injection flaw to retrieve or modify database contents.