Executive brief
PostHog Plugin Server is a backend component used by PostHog to handle data processing pipelines. A SQL injection vulnerability in the ClickHouse table function implementation allows authenticated network-adjacent attackers to execute arbitrary code in the database context, potentially compromising analytics data and the integrity of the entire PostHog installation.
Technical details
This SQL injection vulnerability (CWE-89) exists in PostHog Plugin Server's SQL parser implementation, specifically in ClickHouse table functions. The flaw stems from insufficient validation of user-supplied input before constructing SQL queries. An authenticated attacker with network adjacency can exploit this to inject arbitrary SQL code and achieve remote code execution in the database account context. The vulnerability affects all versions through 1.10.7; patches are available in the referenced commit 6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42.
Affected products
- PostHog Plugin Server 0 through 1.10.7
Timeline
- 2025-04-23: disclosed: Advisory published
- 2025-04-23: patched: Fix available in commit 6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42