Neuron AI
CVE-2025-67510
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Neuron AI agent
-
DeliverySubmit malicious/indirect prompt
-
ExploitLLM invokes MySQLWriteTool
-
ExecutionExecute unrestricted destructive SQL
-
ImpactData destruction or tampering
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires three co-occurring conditions drawn from the advisory: (1) the optional MySQLWriteTool must be explicitly enabled in the agent's toolkit; (2) that agent must be exposed to untrusted input, enabling direct or indirect/stored prompt injection; and (3) the tool must run under a MySQL account with broad privileges (DROP/ALTER/GRANT/TRUNCATE) for high-impact statements to succeed - subject to DB permissions. Limiting factors that sharply reduce real risk: this is a non-default, operator-enabled capability; using a least-privilege DB user (no DROP/ALTER/GRANT) confines impact to at most INSERT/UPDATE; restricting tool use to trusted operators (RBAC/authorization gating) removes untrusted exposure entirely. |
| Impact | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H = 9.4) frames this as a trivially exploitable network-critical flaw, but the reality is more conditional. This is a CWE-250 design 'footgun': MySQLWriteTool intentionally runs arbitrary SQL via PDO::prepare()+execute(), so 'exploitation' means abusing an enabled capability, not defeating a memory-safety bug. Real-world risk depends heavily on deployment: the tool must be (a) enabled, (b) reachable by untrusted/public input, and (c) backed by a broadly-privileged DB user. Given those gates, AC:L is arguably understated - I assess AC:H. Corroborating signals point to modest urgency: EPSS is only 0.41% (32nd percentile), there is no CISA KEV listing, and no public exploit code is referenced. The GitHub-issued advisory and a confirmed fix (2.8.12) are the strongest signals. Net: a legitimately dangerous capability for anyone exposing an agent to untrusted prompts, but the 9.4 headline overstates blanket risk for typical/hardened deployments; treat as a real priority only where the write tool is exposed to untrusted input with a privileged DB account. |
| Exploit ScenarioDerived | An organization deploys a public-facing or user-facing AI agent built on Neuron with MySQLWriteTool enabled and connected to a MySQL user holding broad privileges. An attacker submits crafted input - directly or via indirect/stored prompt injection (e.g., poisoned document or web content the agent ingests) - steering the LLM to call the write tool with a destructive statement such as DROP TABLE or TRUNCATE, which executes without any semantic restriction. No public exploit code is identified at time of analysis; exploitation leverages the tool's documented behavior rather than a discrete PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Arbitrary SQL execution in Neuron AI 2.8.11 and earlier lets a remote, unauthenticated party who can influence an agent's input run destructive statements - DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related commands - through the optional MySQLWriteTool, bounded only by the privileges of the MySQL account the tool connects with. The root cause is that the tool hands caller-supplied SQL directly to PDO::prepare() and execute() with no semantic restrictions, an instance of CWE-250 (Execution with Unnecessary Privileges). Practical exploitation requires three conditions to co-occur: MySQLWriteTool explicitly enabled, the agent exposed to untrusted input for direct or indirect prompt injection, and a broadly privileged DB user, so the published 9.4 (AC:L) score overstates real reach; EPSS is 0.41% (32nd percentile) and no public exploit has been identified at time of analysis. The vendor fixed the issue in 2.8.12.
RemediationAI
Vendor-released patch: upgrade to Neuron AI 2.8.12, which contains the upstream fix (commit 44bab85d92bf162898ee48d0bcef6ba0d29b59c9) and is documented in the GitHub security advisory GHSA-898v-775g-777c and the 2.8.12 release tag. If upgrading immediately is not possible, the advisory's compensating controls are specific: do not enable MySQLWriteTool for public or untrusted agents (this eliminates the untrusted-input path entirely, at the cost of the tool's functionality in those flows); reconfigure the tool's MySQL account to least privilege - no DROP, ALTER, GRANT, or TRUNCATE and no access to sensitive tables - which confines any successful injection to at most INSERT/UPDATE statements; add an application-layer policy that rejects high-risk statements (DROP, TRUNCATE, ALTER, GRANT, REVOKE, CREATE USER) before they reach the tool, accepting that such parsing/allowlisting carries a maintenance burden and potential false negatives; and gate tool invocation behind RBAC or an authorization check so only trusted operators can trigger it, which removes untrusted exposure but restricts agent autonomy. Longer-term hardening suggested by the vendor includes exposing only constrained APIs (insertRecord, updateRecord) with allowlisted tables/columns, and adding a dry-run or human-approval workflow for high-risk statements.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Neuron is a PHP framework for building and orchestrating AI agents, distributed as the Composer package neuron-core/neuron-ai under CPE cpe:2.3:a:neuron-ai:neuron (the wildcard version pattern flags the whole product line, while the advisory scopes the defect to <= 2.8.11). The vulnerable component is MySQLWriteTool (src/Tools/Toolkits/MySQL/MySQLWriteTool.php), a tool that agents can call to perform database writes. The code path passes the string supplied by the model straight into PDO::prepare() followed by execute(); prepared statements parameterize values, not statement structure, so they provide no protection when the entire SQL statement is attacker-influenced. The relevant weakness class is CWE-250 - the tool runs with whatever privileges its configured MySQL account holds, which is far more authority than a write-oriented agent capability should require. The threat model is distinctive to LLM/agent systems: an untrusted user prompt, or indirect/ stored prompt injection from content the agent ingests, can steer the model into emitting a destructive or privilege-related statement that the tool faithfully executes. The upstream fix (commit 44bab85d92bf162898ee48d0bcef6ba0d29b59c9, released as 2.8.12) hardens the validate() signature to enforce a string-typed query argument; the advisory additionally recommends constrained APIs, statement allowlists, and human-approval workflows as durable design mitigations. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H (9.4) as published characterizes a trivially exploitable network flaw; the independent assessment raises the attack-complexity term to AC:H (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) to reflect the prerequisite chain of an operator-enabled tool, an untrusted-input channel, and an over-privileged DB user.
Know when Neuron gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
AC:H because exploitation depends on the write tool being enabled, exposed to untrusted prompts, and backed by a broadly-privileged DB user; PR:N as prompt injection needs no authentication; I:H/A:H from destructive SQL.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Executive ViewAI
Neuron AI 2.8.11 and earlier ship an optional MySQLWriteTool that passes caller-influenced SQL straight to the database, allowing destructive statements such as DROP TABLE, TRUNCATE, DELETE and ALTER against any system the tool's MySQL account can reach. Real-world exposure is narrower than the 9.4 base score implies because three conditions must align - the tool must be explicitly enabled, the agent must accept untrusted input, and the connecting database account must be broadly privileged - but where they do align the blast radius is data destruction or privilege escalation in production databases. No public exploit has been identified at time of analysis and a vendor fix is available, making this a manageable but time-sensitive remediation priority for teams running this component.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Rated medium severity (CVSS 5.3), this
A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Rated medium severity (CVSS 5.3), thi
Neuron AI's MySQLSelectTool (versions 2.8.11 and below) is intended to be a read-only SQL interface for LLM agents, but
Exploit-DB