The vulnerability lies in DataRoom’s MyBatisService.generateSql method, which accepts user‑supplied dataset parameters without proper sanitization. An attacker with a sharer role can supply crafted inputParam values that are inserted into SQL statements as unquoted strings or by using MySQL backslash escapes. This flaw permits the execution of arbitrary SQL commands against the database, potentially allowing data exfiltration, modification, or deletion.

All releases of the DataRoom application provided by GCPaaS up to and including version 3.0.0 are susceptible. The defect was addressed in a patch commit that updated the generateSql implementation.

The CVSS score of 6.0 classifies the issue as moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation. The attack vector is an authenticated HTTP request to the /dataRoom/dataset/run endpoint, requiring a user with a sharer role. Because the end‑points are accessible within the organization, an internal or compromised account could exploit this flaw.