Neuron AI CVE-2025-67509

Requires a deployment that exposes an AI agent using Neuron's MySQLSelectTool to untrusted/attacker-influenced input (e.g., a public agent endpoint susceptible to prompt injection). The arbitrary-file-write-to-RCE outcome additionally requires that the MySQL/MariaDB account used by the tool holds the FILE privilege AND that server configuration (secure_file_priv) permits writes to a useful, ideally web-accessible, directory. Limiting factors: without the FILE privilege or with a restrictive secure_file_priv, the impact is contained to the read-only-filter bypass rather than code execution; exploitation depends on the specific agent being reachable and wired to this tool. Affected versions are 2.8.11 and below; fixed in 2.8.12.

This is a moderate-priority issue whose real-world risk is heavily gated by server-side configuration despite the 8.2 'High' base score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) treats it as remotely reachable without authentication (PR:N), consistent with the described attack surface: a public agent endpoint influenced via prompt injection. However, the described escalation from arbitrary file write to RCE is NOT unconditional - it requires the MySQL/MariaDB account to hold the FILE privilege AND the server's secure_file_priv/config to permit writes to a useful (e.g., web-accessible) directory. These are non-attacker-controlled preconditions, so the AC:L in the input arguably understates real-world complexity. Exploitation signals are low: EPSS is 0.29% (19th percentile), there is no CISA KEV listing, and no public exploit was provided in the intelligence - so this is 'no public exploit identified at time of analysis,' not active exploitation. No SSVC decision data was supplied. Net: a genuine and clever read-only-bypass flaw with a credible path to code execution, but the combination of niche product footprint, dependence on overly-permissive DB privileges, and absence of exploitation evidence places it below internet-facing mass-exploitation threats. Prioritize where a Neuron agent using MySQLSelectTool is exposed to untrusted input and the DB account has FILE privilege.

An attacker sends crafted natural-language input to a publicly exposed AI agent that uses Neuron's MySQLSelectTool, using prompt injection to make the agent issue a query like 'SELECT ... INTO OUTFILE'/'INTO DUMPFILE' that bypasses the first-keyword and forbidden-keyword validation. If the DB account has the FILE privilege and secure_file_priv permits writing to a web-accessible directory, the attacker writes a PHP web shell and achieves remote code execution on the application host. No public exploit code was identified in the provided intelligence, though the GHSA advisory documents the technique in detail.