CVE-2022-1531: SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in rtxteam/rtx

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-29 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.

Affected products

rtxteam/rtx: before 2022-04-20 — fixed in 2022-04-20

How to fix

Upgrade to a fixed version: rtxteam/rtx 2022-04-20. Check the vendor advisory for mitigations.

References

https://github.com/rtxteam/rtx/commit/fa2797e656e3dba18f990a2db1f0f029d41f1921
https://huntr.dev/bounties/fc4eb544-ef1e-412d-9fdb-0ceb04e038fe
https://github.com/rtxteam/rtx/commit/fa2797e656e3dba18f990a2db1f0f029d41f1921
https://huntr.dev/bounties/fc4eb544-ef1e-412d-9fdb-0ceb04e038fe

Get alerted when CVE-2022-1531 or the next vulnerability affects your stack