Jellystat builds SQL queries by directly interpolating unsanitized request-body fields into raw SQL strings for the endpoints POST /api/getUserDetails and POST /api/getLibrary. An attacker who authenticates to the application can inject arbitrary SQL, read every table—including app_config where administrator credentials, API keys, and host URLs are stored— and, because the query is executed via node-postgres' simple query protocol, use stacked statements such as COPY ... TO PROGRAM to execute commands on the PostgreSQL host. With the role used in the provided docker-compose.yml, the database user is a superuser, so no additional privileges are required for the privilege escalation to remote code execution.

The affected product is Jellystat from CyferShepard. Versions prior to 1.1.10 are vulnerable; all releases before the 1.1.10 release contain the flaw.

The CVSS score of 9.1 indicates a high severity vulnerability, and the flaw can lead to full server compromise through the database. While an EPSS score is not available, the vulnerability exists in open‑source code that is publicly accessible, making exploitation more likely. The flaw is not listed in CISA’s KEV catalog. The attack vector is remote and requires the attacker to be able to authenticate and submit POST requests to the vulnerable routes. Once authenticated, the attacker can read sensitive data, access admin credentials, and ultimately run arbitrary commands on the host system.