Platform
python
Component
song-li-cross_browser
Fixed in
690.0.1
CVE-2026-5577 describes a SQL Injection vulnerability discovered in Song-Li cross_browser, affecting versions up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This flaw allows attackers to inject malicious SQL code through manipulation of the ID argument within the Endpoint component. The vulnerability has been publicly disclosed and poses a significant risk to systems utilizing this software, although a fixed version is currently unavailable due to the product's rolling release model.
Successful exploitation of CVE-2026-5577 could allow an attacker to gain unauthorized access to sensitive data stored within the Song-Li cross_browser database. This includes potentially reading, modifying, or deleting data, depending on the database permissions and the attacker's SQL injection payload. The remote nature of the vulnerability means an attacker does not need to be on the same network as the target system to exploit it. Given the SQL Injection nature, the blast radius extends to any data accessible through the vulnerable database, potentially including user credentials, application configuration, and business-critical information. While no specific real-world exploits have been publicly linked to this CVE yet, SQL Injection vulnerabilities are frequently targeted, and the public disclosure increases the likelihood of exploitation.
CVE-2026-5577 has been publicly disclosed, increasing the risk of exploitation. The vulnerability's remote nature and the lack of a readily available patch further exacerbate this risk. The exploit is considered to have a medium probability of exploitation based on the public disclosure and the ease with which SQL Injection vulnerabilities can be exploited. It is not currently listed on CISA KEV. Public proof-of-concept code may emerge, further increasing the likelihood of exploitation. The vulnerability was disclosed on 2026-04-05.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
Due to the rolling release model and lack of a specific fixed version, direct patching is not immediately available. Mitigation strategies should focus on input validation and parameterized queries within the flask/uniquemachine_app.py component. Implement strict input validation on the ID argument, ensuring it conforms to expected data types and lengths. Utilize parameterized queries or prepared statements to prevent SQL injection by separating SQL code from user-supplied data. Consider implementing a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious requests. Regularly review and audit the application's code for potential vulnerabilities. Since a direct upgrade isn't possible, continuous monitoring of the application's logs for suspicious SQL activity is crucial. After implementing these mitigations, verify their effectiveness by attempting to inject SQL payloads through the ID argument and confirming that they are properly sanitized.
Update the Song-Li cross_browser application to a patched version. Due to this being a rolling release and the vendor not responding, it is recommended to review the source code and apply security patches to prevent (SQL Injection) in the 'details' endpoint. Implement input validation and sanitization to prevent malicious argument manipulation.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-5577 is a SQL Injection vulnerability affecting Song-Li cross_browser versions up to ca690f0fe6954fd9bcda36d071b68ed8682a786a, allowing attackers to inject malicious SQL code.
If you are using Song-Li cross_browser versions prior to ca690f0fe6954fd9bcda36d071b68ed8682a786a, you are potentially affected by this vulnerability.
Due to the rolling release model, a direct patch is unavailable. Mitigate by implementing input validation, parameterized queries, and a WAF.
While no confirmed exploitation has been publicly reported, the vulnerability has been disclosed, increasing the risk of exploitation.
The vendor was contacted but did not respond. Check the Song-Li project's website or GitHub repository for updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.