CVE-2026-63224

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the datapoint export API constructs CSV crosstab SQL by concatenating an asset name and attribute name into a COPY query that uses crosstab and streams TO STDOUT. The asset name enters both a double-quoted column identifier and a category query enclosed by the fixed $cat$ delimiter. Escaping single quotes in one string context does not escape embedded double quotes in identifiers or protect that dollar-quote boundary. An authenticated user permitted to create or rename an asset and read/export datapoints for one of its attributes can store SQL metacharacters in the name and request a crosstab export, causing injected SELECT output to be returned in the normal ZIP/CSV response. This enables database exfiltration without direct database or filesystem access or token forgery. In a multi-tenant deployment it can expose other tenants' data if the manager's database role can read shared tables; integrity and availability effects are not established by the demonstrated read primitive. This issue is fixed in version 1.26.0.