Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Security] SQL Injection Vulnerability in datasets and tasks routers

Open
#281 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
20/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
python, sql
Domain
api, databases, security

Research direction

Start with src/routers/openml/datasets.py and src/routers/openml/tasks.py, then review the existing fix in the feature/sql-parameterization branch. Verify that user input uses parameterized placeholders and that dynamic table or column names are restricted to a whitelist; done means the reported SQL injection paths cannot alter query structure.

Written by the indexing model from the issue text.

Description

bug triage
Describe the bug

A critical security vulnerability was identified in the list_datasets and task lookup functions within the routers. The application was using raw string concatenation (f-strings) to build SQL queries from user-provided input.

This creates a high-risk SQL Injection (SQLi) vulnerability, allowing a malicious user to manipulate the query structure and execute unauthorized database commands, leading to potential data loss or unauthorized access.

To Reproduce

Steps to reproduce the behavior:

  1. Send a request to the /datasets/list endpoint.
  2. Provide a tag parameter containing malicious SQL syntax, for example:
    'study_14'); DROP TABLE dataset; --
  3. Result: The server concatenates this string directly into the query, which would attempt to drop the dataset table.
Expected behavior

User input must always be treated as data, never as part of the SQL command structure. All database interactions should:

  • Use parameterized placeholders (Bind Parameters).
  • Strictly validate any dynamic table or column names against a predefined whitelist.
Additional context

This vulnerability was found in the following files:

  • src/routers/openml/datasets.py
  • src/routers/openml/tasks.py

Status: A fix has already been implemented in the branch feature/sql-parameterization and is ready for review.

Dominant language
Python
Stars
16
Forks
50
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openml/server-api

All issues in openml/server-api

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.