{"action":"Upgrade github.com/grafana/grafana to 11.0.6+security-01 or later.","affected":[{"fixed":"11.0.6+security-01","introduced":"11.0.0"},{"fixed":"11.1.7+security-01","introduced":"11.1.0"},{"fixed":"11.2.2+security-01","introduced":"11.2.0"}],"component":"github.com/grafana/grafana","cve_ids":["CVE-2024-9264"],"ecosystem":"Go","epss":0.97553,"exploited":false,"fixed_versions":["11.0.6+security-01","11.1.7+security-01","11.2.2+security-01"],"ghsa_id":"GHSA-q99m-qcv4-fpm7","id":"tcs_01M5KFJRBBW6X5R0Y5B6Z8S0R5","modified_at":"2026-09-10T03:50:19.895134204Z","published_at":"2024-10-18T06:30:32Z","references":["https://osv.dev/vulnerability/GHSA-q99m-qcv4-fpm7","https://nvd.nist.gov/vuln/detail/CVE-2024-9264","https://github.com/grafana/grafana/pull/81666","https://github.com/grafana/grafana","https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264","https://grafana.com/security/security-advisories/cve-2024-9264","https://security.netapp.com/advisory/ntap-20250314-0007"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-q99m-qcv4-fpm7","url":"https://osv.dev/vulnerability/GHSA-q99m-qcv4-fpm7"}],"summary":"Grafana Command Injection And Local File Inclusion Via Sql Expressions"}