PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability

A SQL injection vulnerability allowing remote code execution has been identified in PostHog installations that use ClickHouse table functions. This issue arises from improper validation of user-supplied strings in the SQL parser, enabling authenticated, network-adjacent attackers to execute arbitrary code within the context of the database account.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed with the privileges of the database account.

Remediation

PostHog has released a patch for this vulnerability. Users should update to the latest version.