PatchTheCVECVE-2023-36830: SQLFluff is a SQL linter
CVE-2023-36830 is a medium-severity flaw (CVSS 6.3) affecting sqlfluff. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to be executed via macros. For many users who use SQLFluff in the context of an environment where all users already have fairly escalated privileges, this may not be an issue - however in larger
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 64%) |
| CISA exploited list | No |
| Weakness | CWE-74 |
| Published | 2023-07-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-36830?
sqlfluff: upgrade to 2.1.2. Exact commands for each OS are on this page.
Is CVE-2023-36830 being exploited?
CVE-2023-36830 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-36830 affect?
CVE-2023-36830 affects sqlfluff. Severity is medium (CVSS 6.3). SQLFluff is a SQL linter. Prior to version 2.1.2, in environments where untrusted users have access to the config files, there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitr
How urgent is CVE-2023-36830?
Priority 36/100. Public exploit reference