OData Injection Risk in Low-Code/No-Code Environments

This report highlights OData injection as an under-recognized injection threat in low-code/no-code platforms (e.g., Microsoft Power Platform), explaining how maliciously crafted OData queries—often via unvalidated external inputs—can expose or modify sensitive enterprise data; it emphasizes gaps in LCNC security due to untrained citizen developers and lack of standard mitigations, and recommends automated scanning, developer–security collaboration, input validation/sanitation, and integrating security into the LCNC development lifecycle.