---
id: CVE-2022-3023
aliases:
  - GHSA-7fxj-fr3v-r9gj
title: TiDB vulnerable to Use of Externally-Controlled Format String
summary: TiDB vulnerable to Use of Externally-Controlled Format String
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: pingcap
product: github.com/pingcap/tidb
ecosystem: go
affected:
  - github.com/pingcap/tidb <= 6.1.2
  - 'github.com/pingcap/tidb >= 6.2.0, <= 6.4.0-alpha1'
published: '2022-11-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:46.994032003Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7fxj-fr3v-r9gj'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-3023'
  - url: >-
      https://github.com/pingcap/tidb/commit/d0376379d615cc8f263a0b17c031ce403c8dcbfb
  - url: 'https://advisory.dw1.io/45'
  - url: 'https://github.com/pingcap/tidb'
  - url: 'https://huntr.dev/bounties/120f1346-e958-49d0-b66c-0f889a469540'
tags:
  - osv
  - go
epss: 0.0061
epssPercentile: 0.47875
ingestedAt: '2026-07-16T18:59:42.484Z'
---

## Overview

TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."

## Affected packages

- `github.com/pingcap/tidb <= 6.1.2`
- `github.com/pingcap/tidb >= 6.2.0, <= 6.4.0-alpha1`

## Remediation

Refer to the advisory for the patched release.