SchemaHero 0.23.0 contains an unchecked inclusion of the column parameter in the mysqlColumnAsInsert function, allowing an attacker to inject arbitrary SQL. This flaw could enable unauthorized reading, modification, or deletion of database contents, representing a classic code injection vulnerability classified as CWE‑89.

The only known affected build is SchemaHero version 0.23.0. Earlier or later releases are not listed as vulnerable.

The CVSS score of 7.4 denotes high impact, while an EPSS score below 1% indicates a low current likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Attackers could exploit this flaw remotely if they can supply input to the column argument, such as through API calls or configuration files that invoke mysqlColumnAsInsert, potentially granting full data compromise when sufficient privileges exist.