# CVE-2026-8734: Oinone Pamirs SQL injection in queryListByWrapper interface

Source: https://junglewise.ai/threats/cve-2026-8734-oinone-pamirs-sql-injection-in-querylistbywrapper-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-17. Updated: 2026-05-17  
License: CC BY 4.0 with a link back

CVE-2026-8734 · Severity: high · CVSS 7.3 · Published 2026-05-17

Oinone Pamirs, an AI-driven low-code development framework, contains a security flaw in its data querying interface. An unauthorized attacker can send specially crafted requests to the system to execute arbitrary database commands. This could lead to the unauthorized viewing, modification, or deletion of sensitive business data, potentially granting the attacker full control over the underlying database.

Technologies: [Oinone Pamirs](https://junglewise.ai/threats/technologies/pamirs). Vendors: [Oinone](https://junglewise.ai/threats/vendors/oinone).

## Quick answers

**Is CVE-2026-8734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8734 being exploited in the wild.

**How severe is CVE-2026-8734?** High severity, with a CVSS score of 7.3, published 17 May 2026.

**Which products and versions are affected?** Oinone Pamirs up to 7.2.0.

**Is there a fix for CVE-2026-8734?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8734 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8734?** Check whether you run Oinone Pamirs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Oinone Pamirs framework (up to version 7.2.0) within the RSQLToSQLNodeConnector.makeVariable function of the queryListByWrapper interface. The root cause is the improper neutralization of special characters; specifically, the framework performs direct string concatenation of single quotes when processing RSQL strings without adequate escaping. An unauthenticated remote attacker can use double-quote syntax within an RSQL query to escape string boundaries and inject malicious SQL fragments. This can result in unauthorized data exfiltration, modification, or the execution of administrative database commands (SQL-shell level privileges). As of the advisory date, the vendor has not responded to disclosure attempts, and no official patch is available.

## Affected products

- Oinone Pamirs up to 7.2.0

## Timeline

- 2026-04-22: disclosed: Public disclosure of vulnerability and PoC on GitHub
- 2026-05-17: advisory: NVD/VulDB advisory published

## References

- [https://github.com/SourByte05/SourByte-Lab/issues/12](https://github.com/SourByte05/SourByte-Lab/issues/12)
- [https://vuldb.com/submit/809886](https://vuldb.com/submit/809886)
- [https://vuldb.com/vuln/364322](https://vuldb.com/vuln/364322)
- [https://vuldb.com/vuln/364322/cti](https://vuldb.com/vuln/364322/cti)

## Related threats

- [Oinone Pamirs path traversal in LocalFileClient file upload](https://junglewise.ai/threats/cve-2026-8736-oinone-pamirs-path-traversal-in-localfileclient-file-upload)
- [Oinone Pamirs insecure deserialization in appConfigQuery interface](https://junglewise.ai/threats/cve-2026-8735-oinone-pamirs-insecure-deserialization-in-appconfigquery-interface)
- [Oinone Pamirs remote code execution in ScriptRunner](https://junglewise.ai/threats/cve-2026-39052-oinone-pamirs-remote-code-execution-in-scriptrunner)