From a29907aa86220bca5502c01eb0abebe00562f4c9 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 23 Apr 2025 19:40:29 +0000
Subject: [PATCH] Publish GHSA-v64v-fq96-c5wv

---
 .../GHSA-v64v-fq96-c5wv.json                  | 33 ++++++++++++++++---
 1 file changed, 29 insertions(+), 4 deletions(-)
 rename advisories/{unreviewed => github-reviewed}/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json (67%)

diff --git a/advisories/unreviewed/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json b/advisories/github-reviewed/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json
similarity index 67%
rename from advisories/unreviewed/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json
rename to advisories/github-reviewed/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json
index d105153ef1f..24bef09d89a 100644
--- a/advisories/unreviewed/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json
+++ b/advisories/github-reviewed/2025/04/GHSA-v64v-fq96-c5wv/GHSA-v64v-fq96-c5wv.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v64v-fq96-c5wv",
-  "modified": "2025-04-23T18:30:58Z",
+  "modified": "2025-04-23T19:38:40Z",
   "published": "2025-04-23T18:30:58Z",
   "aliases": [
     "CVE-2025-1520"
   ],
+  "summary": "PostHog Plugin Server SQL Injection Vulnerability",
   "details": "PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PostHog. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the SQL parser. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the database account. Was ZDI-CAN-25350.",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@posthog/plugin-server"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.10.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -23,6 +44,10 @@
       "type": "WEB",
       "url": "https://github.com/PostHog/posthog/commit/6e8f035f9acd339c5ba87ba6ea40fc1ab3053d42"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/PostHog/plugin-server"
+    },
     {
       "type": "WEB",
       "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-099"
@@ -33,8 +58,8 @@
       "CWE-89"
     ],
     "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-23T19:38:40Z",
     "nvd_published_at": "2025-04-23T17:16:52Z"
   }
 }
\ No newline at end of file