- Yama var
- Son 7 gün
- CWE-436
- CWE-863
CVE-2026-61789
DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
- Yayımlandı
- Güncellendi
- 30 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and MariaDB require following whitespace, a control character, or the end of the line. The read-only check in src/tools/execute-sql.ts validates split statements with isReadOnlySQL, but src/connectors/mysql/index.ts and src/connectors/mariadb/index.ts execute the original string with multipleStatements enabled. A double dash followed by a non-whitespace character can therefore hide a subsequent write or destructive DDL statement from the validator while the database interprets the dashes as minus operators and executes both statements. Anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can bypass read-only mode to modify or drop database data, subject to the database account's privileges. PostgreSQL is not affected by this path because its double-dash parsing agrees with the checker and its connector executes individual split statements. This issue is fixed in version 0.22.6.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| bytebase dbhub | < 0.22.6 | 0.22.6 |
Kaynaklar6 kaynak
Kayıt geçmişi
- Yayımlandı