CVE-2026-103244

Summary

This vulnerability allows unauthenticated attackers to execute arbitrary SQL during the first-run setup mode, enabling them to plant admin users and session tokens, leading to full application takeover.

Exploitability

Exploitation is relatively straightforward as it requires invoking the setup.restore command via Socket.IO, which can be done with minimal technical expertise.

Blast radius

If exploited, the impact is critical as it grants complete control over the application, potentially leading to data theft, system compromise, and loss of integrity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.8.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.