BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 19, 2026 · NIST NVD

   Detected

   BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with

2. Jul 24, 2026 · NIST NVD

   Updated

   BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier quoting. Although filter values are parameterized, the filter identifiers (keys) are not. An authenticated attacker with

Sources

• CVE.orgVulnerability recordCVE-2026-31069

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-31069

  BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and aggregation properties is directly interpolated into SQL queries using sprintf() without proper sanitization or identifier

  nvd.nist.gov

References

• Reference · gist.github.com
• Reference · gist.github.com
• Reference · github.com