ChirpStack’s SQLite backend allows authenticated users with device‑list privileges to inject arbitrary SQL by supplying a specially crafted tag key in the device filter of ListDevices. The source of the flaw is the direct interpolation of the tag key into a raw SQL string using Rust’s format!() macro while only the tag value is parameter‑bound, enabling an attacker to execute unintended SQL statements. This classic unsanitised input flaw is identified as CWE-89 and can compromise confidentiality, integrity, and potentially availability of the SQLite database.

All installations of chirpstack that rely on the SQLite backend (chirpstack-sqlite package) are affected. The PostgreSQL backend remains unaffected because it uses parameterised JSONB operators instead of raw SQL. Deployments where users possess device‑list permissions and the backend is configured as SQLite are vulnerable.

The CVSS score of 6.5 indicates a high‑impact vulnerability, though the EPSS score of 0.00227 (~0.23%) indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker needs authenticated access with device‑list privileges to exploit this weakness, using the tag key filter as the injection vector. Once the conditions are met, the injection is straightforward and could allow arbitrary database queries or modifications.