ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

Summary

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.

Remediation

1. Inventory every mqttsnet thinglinks deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/mqttsnet/thinglinks/security/advisories/GHSA-gcj7-r5wv-348x
• Referencehttps://github.com/mqttsnet/thinglinks/commit/60e7a934753638f916a665d2d24c4377344c7599
• Referencehttps://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0