Cyber Resilience

CVE-2026-29953

HighPublic PoC

Published: 30 March 2026

Published
30 March 2026
Modified
02 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0004 12.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-29953 is a high-severity SQL Injection (CWE-89) vulnerability in Schemahero Schemahero. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-29953 is a SQL injection vulnerability (CWE-89) affecting SchemaHero version 0.23.0. The flaw exists in the column parameter passed to the columnAsInsert function within the file plugins/postgres/lib/column.go. Published on 2026-03-30, it carries a CVSS v3.1 base score of 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, and potential for scope change.

An attacker with low privileges can exploit this vulnerability over the network without user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling unauthorized data access, modification, or disruption within the affected PostgreSQL plugin context due to the SQL injection.

Mitigation details and advisories are available in the referenced sources, including a GitHub Gist at https://gist.github.com/b0b0haha/fb59199fb1fdf9414e76442e0599bfed and a README at https://github.com/b0b0haha/SchemaHero--Sqlinjection/blob/main/README.md, which security practitioners should consult for patching guidance and further technical analysis.

EU & UK References

Vulnerability details

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection (CWE-89) with network attack vector (AV:N) and low privileges directly enables remote exploitation of the SchemaHero Postgres plugin, mapping to T1190 for achieving limited data access/modification via crafted column input.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-33643Same product: Schemahero Schemahero
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89

Affected Assets

schemahero
schemahero
≤ 0.23.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by requiring validation and sanitization of the untrusted 'column' parameter passed to columnAsInsert in SchemaHero's PostgreSQL plugin.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of the specific SQL injection flaw in SchemaHero version 0.23.0.

SI-9 Information Input Restrictions partial match
prevent

Restricts input to the 'column' parameter to authorized types, formats, and quantities, blocking SQL injection payloads.

References