An SQL injection flaw exists in runZero Platform’s saved queries feature, first appearing in release 4.0.260123.0. The vulnerability allows an attacker to inject arbitrary SQL commands through manipulated query parameters. As a result, the attacker could read, modify, or delete records in the platform’s database, directly impacting confidentiality, integrity, and availability of the stored data. This weakness maps to CWE‑89 and carries a CVSS v3.1 score of 6.4, indicating medium severity.

The affected product is runZero Platform. Versions prior to 4.0.260123.1 contain the vulnerability; the issue was addressed and fixed in release 4.0.260123.1. Users running the earlier build, particularly 4.0.260123.0, must upgrade to the patched version to eliminate the risk.

The medium CVSS score reflects a reasonable risk level, but the lack of EPSS data or KEV listing suggests exploitation may not be widespread yet. The likely attack vector requires authenticated access that permits creation or editing of saved queries—typically through the web UI or API. When an attacker supplies a crafted query, the unsanitized input is executed against the database, potentially exposing or tampering with sensitive information.