CVE-2023-24812 SQL injection of notes/search-by-tag

What is CVE-2023-24812?

CVE-2023-24812 is a high-severity SQL injection vulnerability in misskey-dev misskey, published on 22 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the `api/notes/search-by-tag` endpoint.

Weakness: CWE-89

Which versions are affected by CVE-2023-24812?

It affects 1 product.

Products include Misskey Misskey.

How do I fix CVE-2023-24812?

No fix has been published for CVE-2023-24812 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-24812 being exploited?

There is no known exploitation of CVE-2023-24812 in the wild and no public exploit code.

Other vulnerabilities in misskey-dev misskey

• CVE-2025-25306 Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes Critical 9.3
• CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user. Critical 9.3
• CVE-2026-28431 Misskey lacks proper authorization checks and input validation Critical 9.2
• CVE-2023-52139 Misskey vulnerable to improper authorization when accessing with third-party application Critical 9.1
• CVE-2024-52590 Missing validation allows spoofed profiles in Misskey High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cgwp-vmr4-wx4q.