The AI-written code passed user-controlled timeframe and additionalFilter input directly into a DQL execution, enabling DQL injection.

+        .string()+        .optional()+        .default('30d')+        .describe(+          'Timeframe to query vulnerabilities (e.g., "12h", "24h", "7d", "30d", "90d"). Default: "30d". Supports hours (h) and days (d).',+        ),       riskScore: z         .number()         .optional()@@ -376,27 +383,27 @@ const main = async () => {     {       readOnlyHint: true,     },-    async ({ riskScore, additionalFilter, maxVulnerabilitiesToDisplay }) => {+    async ({ timeframe, riskScore, additionalFilter, maxVulnerabilitiesToDisplay }) => {       const dtClient = await createAuthenticatedHttpClient(         scopesBase.concat(           'storage:events:read',           'storage:buckets:read',           'storage:security.events:read', // Read Security events from Grail         ),       );-      const result = await listVulnerabilities(dtClient, additionalFilter, riskScore);+      const result = await listVulnerabilities(dtClient, additionalFilter, riskScore, timeframe);       if (!result || result.length === 0) {-        return 'No vulnerabilities found in the last 30 days';+        return `No vulnerabilities found in the last ${timeframe}`;       }-      let resp = `Found ${result.length} vulnerabilities in the last 30 days! Displaying the top ${maxVulnerabilitiesToDisplay} vulnerabilities:\n`;+      let resp = `Found ${result.length} vulnerabilities in the last ${timeframe}! Displaying the top ${maxVulnerabilitiesToDisplay} vulnerabilities:\n`;       result.slice(0, maxVulnerabilitiesToDisplay).forEach((vulnerability) => {         resp += `\n* ${vulnerability}`;       });        resp +=         `\nNext Steps:` +         `\n1. For specific vulnerabilities, first always fetch more details using the "execute_dql" tool and the following query:-          "fetch security.events, from: now()-30d, to: now()+          "fetch security.events, from: now()-${timeframe}, to: now()             | filter event.provider=="Dynatrace"                     AND event.type=="VULNERABILITY_STATE_REPORT_EVENT"                     AND event.level=="ENTITY"@@ -1011,6 +1018,13 @@ const main = async () => {     'Get Kubernetes Events',     'Get all events from a specific Kubernetes (K8s) cluster',     {+      timeframe: z+        .string()+        .optional()+        .default('24h')+        .describe(+          'Timeframe to query events (e.g., "12h", "24h", "7d", "30d"). Default: "24h". Supports hours (h) and days (d).',+        ),       clusterId: z         .string()         .optional()@@ -1046,12 +1060,12 @@ const main = async () => {     {       readOnlyHint: true,     },-    async ({ clusterId, kubernetesEntityId, eventType, maxEventsToDisplay }) => {+    async ({ timeframe, clusterId, kubernetesEntityId, eventType, maxEventsToDisplay }) => {       const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('storage:events:read'));-      const result = await getEventsForCluster(dtClient, clusterId, kubernetesEntityId, eventType);+      const result = await getEventsForCluster(dtClient, clusterId, kubernetesEntityId, eventType, timeframe);        if (result && result.records && result.records.length > 0) {-        let resp = `Found ${result.records.length} events! Displaying the top ${maxEventsToDisplay} events:\n`;+        let resp = `Found ${result.records.length} events in the last ${timeframe}! Displaying the top ${maxEventsToDisplay} events:\n`;         // iterate over dqlResponse and create a string with the problem details, but only show the top maxEntitiesToDisplay problems         result.records.slice(0, maxEventsToDisplay).forEach((event) => {           if (event) {@@ -1062,12 +1076,12 @@ const main = async () => {         resp +=           `\nNext Steps:` +           `\n1. Consider filtering by \`eventType\` to find specific events of interest.` +-          `\n2. Use "execute_dql" tool with the following query to get more details about a specific event: "fetch events | filter event.id == \"<event-id>\""`;+          `\n2. Use "execute_dql" tool with the following query to get more details about a specific event: "fetch events, from: now()-${timeframe}, to: now() | filter event.id == \"<event-id>\""`;          return resp;       } 

+ * List vulnerabilities from security.events+ * @param dtClient Dynatrace HTTP Client+ * @param additionalFilter Any additional DQL filter+ * @param riskScore Minimum risk score to filter vulnerabilities (default: 8.0)+ * @param timeframe Timeframe to query vulnerabilities (e.g., '24h', '7d', '30d'). Default: '30d'+ * @returns Array of formatted vulnerability strings+ */+export const listVulnerabilities = async (+  dtClient: HttpClient,+  additionalFilter?: string,+  riskScore?: number,+  timeframe: string = '30d',+) => {+  // DQL query to fetch vulnerabilities with configurable timeframe+  const dqlStatement = `fetch security.events, from: now()-${timeframe}, to: now()     | filter dt.system.bucket=="default_securityevents_builtin"         AND event.provider=="Dynatrace"         AND event.type=="VULNERABILITY_STATE_REPORT_EVENT"

+ * @param kubernetesEntityId The Dynatrace Kubernetes Entity ID (dt.entity.kubernetes_cluster)+ * @param eventType Filter by specific event type+ * @param timeframe Timeframe to query events (e.g., '12h', '24h', '7d', '30d'). Default: '24h'+ * @returns DQL query result+ */ export const getEventsForCluster = async (   dtClient: HttpClient,   clusterId: string,   kubernetesEntityId: string,   eventType: string,+  timeframe: string = '24h', ) => {-  let dql = 'fetch events';+  let dql = `fetch events, from: now()-${timeframe}, to: now()`;    if (!clusterId && !kubernetesEntityId) {     // If no clusterId or kubernetesEntityId is provided, return all kubernetes related events

@@ -15,6 +16,9 @@ export const listVulnerabilities = async (   riskScore?: number,   timeframe: string = '30d', ) => {+  validateTimeframe(timeframe);+  if (additionalFilter) validateAdditionalFilter(additionalFilter);+   // DQL query to fetch vulnerabilities with configurable timeframe   const dqlStatement = `fetch security.events, from: now()-${timeframe}, to: now()     | filter dt.system.bucket=="default_securityevents_builtin"

   additionalFilter?: string,   timeframe: string = '24h',   maxResultRecords: number = 5000, ) => {+  validateTimeframe(timeframe);+  if (additionalFilter) validateAdditionalFilter(additionalFilter);+   // DQL statement to fetch exception data from user.events for the specified timeframe   const dql = `fetch user.events, from: now()-${timeframe}, to: now() | filter isNotNull(exception.stack_trace)