CVE-2023-24812: SQL injection of notes/search-by-tag

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-22 · updated 2026-06-17
Weakness: CWE-89

Description

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the `api/notes/search-by-tag` endpoint.

Affected products

misskey-dev misskey: before 13.3.3 — fixed in 13.3.3

How to fix

Upgrade to a fixed version: misskey-dev misskey 13.3.3. Check the vendor advisory for mitigations.

References

https://github.com/misskey-dev/misskey/commit/ee74df68233adcd5b167258c621565f97c3b2306
https://github.com/misskey-dev/misskey/security/advisories/GHSA-cgwp-vmr4-wx4q
https://github.com/misskey-dev/misskey/commit/ee74df68233adcd5b167258c621565f97c3b2306
https://github.com/misskey-dev/misskey/security/advisories/GHSA-cgwp-vmr4-wx4q

Get alerted when CVE-2023-24812 or the next vulnerability affects your stack