CVE-2022-39303: Ree6 vulnerable to SQL Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-13 · updated 2026-06-17
Weakness: CWE-89

Description

Ree6 is a moderation bot. This vulnerability allows manipulation of SQL queries. This issue has been patched in version 1.7.0 by using Javas PreparedStatements, which allow object setting without the risk of SQL injection. There are currently no known workarounds.

Affected products

Ree6-Applications Ree6: before 1.7.0 — fixed in 1.7.0

How to fix

Upgrade to a fixed version: Ree6-Applications Ree6 1.7.0. Check the vendor advisory for mitigations.

References

https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7.
https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-69xv-xjfw-4pv8
https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7.
https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-69xv-xjfw-4pv8

Get alerted when CVE-2022-39303 or the next vulnerability affects your stack