CVE-2022-41892
Arches vulnerable to SQL Injection
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Arches vulnerable to SQL Injection
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
- Record
CVE-2022-41892- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2022-0027
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
- Record
EUVD-2022-0027- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gmpq-xrxj-xh8m
Arches vulnerable to execution of arbitrary SQL
Impact
With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database.
Anyone running the impacted versions (<=6.1.1, 6.2.0, >=7.0.0, <=7.1.1) should upgrade as soon as possible.
Patches
The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2.0 Users are strongly urged to upgrade to the most recent relevant patch.
Workarounds
There are no workarounds.
General References
https://www.w3schools.com/sql/sql_injection.asp https://en.wikipedia.org/wiki/SQL_injection
For more information
Post any questions to the Arches project forum.
- Record
GHSA-gmpq-xrxj-xh8m- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
- Record
CVE-2022-41892- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Arches vulnerable to SQL Injection
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
- Record
CVE-2022-41892- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-gmpq-xrxj-xh8m
Arches vulnerable to execution of arbitrary SQL
Impact
With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database.
Anyone running the impacted versions (<=6.1.1, 6.2.0, >=7.0.0, <=7.1.1) should upgrade as soon as possible.
Patches
The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2.0 Users are strongly urged to upgrade to the most recent relevant patch.
Workarounds
There are no workarounds.
General References
https://www.w3schools.com/sql/sql_injection.asp https://en.wikipedia.org/wiki/SQL_injection
For more information
Post any questions to the Arches project forum.
- Record
GHSA-gmpq-xrxj-xh8m- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVPYSEC-2022-42985 No score
Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.2 are vulnerable to SQL Injection. With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. This issue is fixed in version 7.12, 6.2.1, and 6.1.2. Users are recommended to upgrade as soon as possible. There are no workarounds.
- Record
PYSEC-2022-42985- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
archesPyPI |
through 6.1.1 | 6.1.2 |
archesPyPI |
6.2.0 to 6.2.0 | 6.2.1 |
archesPyPI |
7.0.0 to 7.1.1 | 7.2.0 |
archesPyPI |
before 6.1.2, plus listed versions 3.03.0.13.0.23.0.33.0.4 Show 40 moreShow less3.0.53.0rc103.0rc113.0rc123.0rc133.0rc143.0rc63.0rc73.0rc83.0rc93.13.1.13.1.24.04.0.14.0b04.0b14.0b24.0b34.14.1.14.24.34.3.14.3.24.3.34.44.4.14.4.24.4.35.05.1.05.1.15.1.25.1.35.1.46.0.06.0.16.1.06.1.1 |
6.1.2 |
archesPyPI |
6.2.0 up to 6.2.1 | 6.2.1 |
archesPyPI |
7.0.0 up to 7.2.0, plus listed versions 7.1.07.1.1 |
7.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-41892 is a high vulnerability (CVSS 8.6) in Archesproject Arches, published November 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in arches 6.1.2.
References
github.com/archesproject/arches/security/advisories/GHSA-gmpq-xrxj-xh8m
nvd.nist.gov/vuln/detail/CVE-2022-41892
pypi.org/project/arches/6.1.2