Cap-go before version 12.128.2 contains SQL injection flaws in cloudflare.ts. User‑controlled fields from API request bodies—such as deviceIds, search, version_name, cursor, and actions—are concatenated directly into SQL query strings without sanitization or parameterization. This allows an attacker to inject arbitrary SQL statements that can read, modify, or delete analytics data belonging to other users or applications.

Cap‑go, all deployments running a version earlier than 12.128.2. The vulnerability exists in the cloudflare.ts module of the Cap‑go application and applies to any instance that exposes the Analytics Engine API.

The CVSS score of 7.1 indicates a moderate‑to‑high level of risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who possess a read‑level API key can exploit the flaw by sending crafted request bodies to the Analytics Engine endpoints. This authenticated attack vector can grant unauthorized access to sensitive analytical data, potentially compromising confidentiality. No elevation of privilege or remote code execution is described, so the threat is focused on data exposure.