Affected Grit42 Grit includes a flaw in the Grit::Assays::DataTableEntity function within data_table_entity.rb that permits the crafting of request parameters to inject arbitrary SQL. The injection could lead to unauthorized data exposure, manipulation, or deletion. This vulnerability is classified as a classic SQL Injection and is considered a moderate threat.

The issue applies to Grit42 Grit versions up to 0.11.0. Any deployment of these versions that exposes the DataTableEntity endpoint to external input is potentially vulnerable. The problem originates from the backend app models handling assay data, specifically the data_table_entity module.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, and the public availability of exploit code suggests that a motivated attacker could exploit it without special local access. The risk is confined to systems that expose the vulnerable endpoint and accept untrusted input.