CVE-2022-30331
** DISPUTED ** The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation...
The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."
- Record
CVE-2022-30331- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."
- Record
CVE-2022-30331- Updated
- 2026-11-02
EUVDEUVD-2022-0221 No score
The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."
- Record
EUVD-2022-0221- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-56x5-64f5-4m37
** DISPUTED ** The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation...
** DISPUTED ** The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."
- Record
GHSA-56x5-64f5-4m37- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVPYSEC-2022-43064
The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper validation. Consequently, an attacker can execute arbitrary C++ code. NOTE: the vendor's position is "GSQL was behaving as expected."
- Record
PYSEC-2022-43064- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pytigergraphPyPI |
All versions, plus listed versions 0.0.0.50.0.20.0.30.0.40.0.4.5 Show 45 moreShow less0.0.4.60.0.4.70.0.4.7.10.0.4.7.20.0.4.7.30.0.4.7.40.0.4.7.50.0.4.7.60.0.50.0.5.10.0.5.20.0.5.30.0.5.40.0.5.50.0.5.60.0.5.70.0.5.80.0.6.00.0.6.10.0.6.20.0.6.30.0.6.40.0.6.50.0.6.60.0.6.70.0.6.80.0.6.90.0.70.0.80.0.8.10.0.8.20.0.8.40.0.8.50.0.90.0.9.10.0.9.20.0.9.30.0.9.40.0.9.50.0.9.6.20.0.9.6.30.0.9.6.40.0.9.6.50.0.9.6.60.0.9.6.7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30331 is a high vulnerability (CVSS 8.8) in Tigergraph, published September 5, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile.
References
Left out here: 70 versions. The JSON record has them.