The parsl-visualize component builds SQL statements with unsafe string formatting, concatenating user‑provided workflow identifiers directly into the query. This flaw falls under CWE‑89 and permits an attacker to inject arbitrary SQL, which can expose monitoring data or disrupt the database by causing corruption or denial of service.

The vulnerability affects the Parsl library, specifically the parsl‑visualize dashboard, in all releases prior to 2026.01.05. Users relying on earlier versions should confirm their installation date and update if necessary.

The CVSS score of 5.3 reflects moderate severity, and the EPSS score below 1 % indicates a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An unauthenticated attacker who can access the monitoring dashboard can exploit the flaw, suggesting a network or web‐interface attack vector. No special prerequisites beyond access to the dashboard are required.