Metabase vulnerable to Remote Code Execution via H2

8.8 CVSS

Vulnerability Description

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 (Sample Database) could allow Remote Code Execution (RCE), which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Metabase no longer allows DDL statements in H2 native queries.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39361

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/metabase/metabase/security/advisories/GHSA-gqpj-wcr3-p88v

More from metabase

View All →

CVE-2025-32382

Snowflake credentials logged by the Metabase backend

Low 1.8

CVE-2025-30371

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Low 2.1

CVE-2025-27141

Metabase Enterprise Edition allows cached questions to leak data to impersonated users

Medium 4.8

CVE-2024-55951

Metabase sandboxed users could see filter values from other sandboxed users

Medium 4.8

CVE-2023-37470

Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint

Critical 10

Affected Vendor

metabase

View all reports →

Affected Software

metabase

Vulnerable Versions:

< 0.41.9, >= 0.42.0, < 0.42.6, >= 0.43.0, < 0.43.7, >= 0.44.0, < 0.44.5, >= 1.0.0, < 1.41.9, >= 1.42.0, < 1.42.6, >= 1.43.0, < 1.43.7, >= 1.44.0, < 1.44.5