v1.8.3

Expensify/Appv1.8.3Apr 7, 2026by lfnovo

AI Summary

Security release fixing SurrealDB injection vulnerability via unsanitized order_by query parameter. Added defensive validations and replaced unsafe query interpolation with parameterized binding.

Key Highlights

Fixed SurrealDB injection via unsanitized order_by parameter (CVSS 8.7 High)
Added allowlist validation for sorting parameters in notebooks endpoint
Replaced f-string query interpolation with parameterized $variable binding
Added defensive validation in get_all() base method
Exploitable via CSRF by tricking users into clicking crafted URLs

New Features

Security fixes for SQL injection vulnerabilities
Parameterized query binding for source chat and migration queries

Full Release Notes

## Security

- **Fix SurrealDB injection via unsanitized `order_by` query parameter** (CVSS 8.7 High)
  - `GET /api/notebooks` accepted arbitrary input in the `order_by` parameter, allowing injection of SurrealQL commands. Exploitable via CSRF by tricking a user into clicking a crafted URL.
  - Added allowlist validation for sorting parameters in the notebooks endpoint
  - Replaced f-string query interpolation with parameterized `$variable` binding in source chat and migration queries
  - Added defensive validation in the `get_all()` base method to prevent injection via `order_by` parameter

### Affected versions

All versions up to and including v1.8.2.

### Recommended action

Upgrade to v1.8.3 immediately.

### Credit

Reported by [CERT-EU](https://cert.europa.eu) Offensive Security Team via coordinated vulnerability disclosure.