【中文导读】该 CVE 涉及命令注入、文件包含（严重风险）。具体受影响产品、版本和修复方案以 NVD/厂商公告为准。 【原始描述】The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.