Parsl: SQL injection in the monitoring dashboard
Parsl's monitoring visualization built SQL queries by pasting the workflow ID from the URL straight into the query string, with no parameterization.
- Package
- parsl (PyPI)
- Affected
- < 2026.01.05
- Fixed in
- 2026.01.05
- Weakness
- CWE-89 SQL injection
- Severity
- Moderate, CVSS 3.1 score 5.3
- Advisory
- GHSA-f2mf-q878-gh58
Severity
5.3CVSS 3.1
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
What was the issue
Parsl is a Python library for parallel scientific workflows, with an optional web dashboard for monitoring runs. In parsl/monitoring/visualization/views.py, route handlers took workflow_id from the URL and inserted it into raw SQL strings with Python's % formatting, including a query passed to pd.read_sql_query.
Impact
Anyone who could reach a running monitoring dashboard could change the query. The advisory describes extracting data from the monitoring database with UNION-based injection, bypassing filters with boolean conditions, and slowing the service with expensive queries.
GitHub scored it 5.3 (Moderate), counting availability impact only, even though the advisory text describes data extraction as well.
What to do
Upgrade Parsl to 2026.01.05 or later, and keep the monitoring dashboard off untrusted networks.
Disclosure timeline
Reported privately to the Parsl maintainers.
Advisory and fixed release 2026.01.05 published.
Published in NVD.
The takeaway. Internal dashboards get exposed eventually. Parameterized queries cost nothing and remove the whole bug class.
